fix(ci): detect stale workspace lockfile entries (#11714)

Removes stale nested browser-pool lock entries pinning Playwright 1.61.1/@types/node 22 despite the workspace declaring 1.62.1/26, and extends the lockfile gate with npm ls --workspaces --depth=0 so future manifest/lock drift fails visibly. 21/21 focused tests passing. Thanks!

scripts/check/check-lockfile.mjs

@@ -7,6 +7,7 @@
 //   --validate-https       → toda URL "resolved" deve usar HTTPS (bloqueia http://)
 //   --validate-integrity   → todo pacote deve ter hash de integridade sha512
 //   --allowed-hosts npm    → apenas registry.npmjs.org é host permitido
+//   npm ls --workspaces    → entradas do lockfile satisfazem cada workspace
 //
 // Complementa check-deps (Fase 2 / allowlist de nomes): aquele garante que só
 // nomes aprovados entram; este garante que os pacotes instalados vieram do registry
@@ -57,10 +58,7 @@ export function getLockfileLintConfig() {
  * @returns {string[]}
  */
 export function buildLockfileLintArgs(cfg) {
-  const args = [
-    "--path", cfg.lockfilePath,
-    "--type", cfg.type,
-  ];
+  const args = ["--path", cfg.lockfilePath, "--type", cfg.type];
   if (cfg.validateHttps) args.push("--validate-https");
   if (cfg.validateIntegrity) args.push("--validate-integrity");
   if (cfg.allowedHosts.length) {
@@ -69,6 +67,67 @@ export function buildLockfileLintArgs(cfg) {
   return args;
 }
 
+/**
+ * Returns the cross-platform npm command that verifies direct workspace
+ * dependencies from package-lock.json, independent of the installed tree.
+ *
+ * @param {NodeJS.Platform} [platform]
+ * @param {string | undefined} [comSpec]
+ * @returns {{ command: string, args: string[] }}
+ */
+export function getWorkspaceDependencyCheckCommand(
+  platform = process.platform,
+  comSpec = process.env.ComSpec
+) {
+  const npmArgs = ["ls", "--workspaces", "--depth=0", "--package-lock-only"];
+  if (platform === "win32") {
+    return {
+      command: comSpec || "cmd.exe",
+      args: ["/d", "/s", "/c", "npm.cmd", ...npmArgs],
+    };
+  }
+
+  return {
+    command: "npm",
+    args: npmArgs,
+  };
+}
+
+/**
+ * Executes the workspace dependency consistency check while keeping the process
+ * boundary injectable for deterministic success and failure tests.
+ *
+ * @param {{
+ *   platform?: NodeJS.Platform,
+ *   comSpec?: string,
+ *   execFile?: typeof execFileSync,
+ * }} [options]
+ * @returns {{ ok: true } | { ok: false, stdout: string, stderr: string }}
+ */
+export function runWorkspaceDependencyCheck(options = {}) {
+  const {
+    platform = process.platform,
+    comSpec = process.env.ComSpec,
+    execFile = execFileSync,
+  } = options;
+  const workspaceCheck = getWorkspaceDependencyCheckCommand(platform, comSpec);
+
+  try {
+    execFile(workspaceCheck.command, workspaceCheck.args, {
+      cwd: ROOT,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    return { ok: true };
+  } catch (err) {
+    return {
+      ok: false,
+      stdout: err.stdout ?? "",
+      stderr: err.stderr ?? "",
+    };
+  }
+}
+
 function main() {
   const cfg = getLockfileLintConfig();
 
@@ -111,6 +170,17 @@ function main() {
     );
     process.exit(1);
   }
+
+  const workspaceResult = runWorkspaceDependencyCheck();
+  if (workspaceResult.ok) {
+    console.log("[check-lockfile] OK — workspace lock entries match their manifests");
+  } else {
+    console.error("[check-lockfile] FAIL — workspace lock entries are inconsistent:");
+    if (workspaceResult.stdout) console.error(workspaceResult.stdout);
+    if (workspaceResult.stderr) console.error(workspaceResult.stderr);
+    console.error("\n  → Regenerate the affected lock entries and verify with a clean `npm ci`");
+    process.exit(1);
+  }
 }
 
 if (import.meta.url === pathToFileURL(process.argv[1] || "").href) main();