fix(bundle): declare Node >=20 and install the shipped lockfile with npm ci

CHANGELOG.md

@@ -20,6 +20,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- The release bundle's manifest now declares Node `>=20` (it said `>=16`,
+  contradicting CONTRIBUTING.md and every real floor in the repo) and installs
+  the shipped lockfile with `npm ci` instead of `npm install`, so consumer
+  installs from the release asset are reproducible and never mutate the
+  lockfile in place ([#162](https://github.com/QuantEcon/quantecon-theme.mystmd/issues/162)).
+
 ## [2.6.1] - 2026-09-10
 
 ### Fixed

template.yml

@@ -65,7 +65,13 @@ options:
       Accessible name and tooltip of the language switcher, in the edition's own
       language ("Switch language" when unset).
 build:
-  install: npm install
+  # `npm ci`, not `npm install`: the release asset ships a lockfile (release.yml
+  # generates it with `npm install --package-lock-only` and it is in `files`
+  # below), so consumer installs are reproducible and the lockfile is never
+  # mutated in place. `npm ci` fails without a lockfile, but the only
+  # lockfile-less path is a source checkout, which is not a usable template
+  # until `make build-theme` has run -- and that target installs its own.
+  install: npm ci
   start: npm run start
 files:
   - server.js

template/package.json

@@ -17,6 +17,6 @@
     "morgan": "^1.10.0"
   },
   "engines": {
-    "node": ">=16"
+    "node": ">=20"
   }
 }