[codex] Fix post-merge health checks

[blove]

Summary

• install npm 11 into a temporary prefix for the release workflow instead of mutating the runner's active npm installation
• move OpenSSF Scorecard write scopes to job-level permissions while keeping workflow-global permissions read-only
• scope the drawer smoke test to the exact in-drawer /docs link to avoid WebKit pointer interception

Verification

• ruby -e 'require "yaml"; ARGV.each { |file| YAML.load_file(file); puts file }' .github/workflows/release.yml .github/workflows/scorecard.yml .github/workflows/ci.yml\n- temp-prefix npm install --global npm@11.14.1 returned 11.14.1\n- pnpm --filter @pretable/app-website exec playwright test e2e/smoke.spec.ts --project=webkit -g "docs brand link returns" --repeat-each=5\n- pnpm --filter @pretable/app-website exec playwright test e2e/smoke.spec.ts e2e/docs.spec.ts\n- pnpm format\n- pnpm lint\n- pnpm typecheck

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
pretable	Ignored		May 8, 2026 7:11pm

[github-actions]

Vercel preview ready

Preview: https://pretable-lfort6qtf-cacheplane.vercel.app
Commit: d7387dced8f2b1e0b934cc563597e5d5962c3f3b

_{Updated automatically by the deploy-preview job.}