fix(ci): give the statepoints root-dominance job the node setup it needs (#8172)

`gc-root-dominance-statepoints` has failed on every `main` run and every
PR since #8084, with "node_modules/zod/src/index.ts is missing".

#8084 added the dependency-scale native corpus to this job. That corpus
compiles `node_modules/zod`, but `actions/setup-node` and `npm ci` live
only in the sibling `gc-root-dominance` job, so this one died in setup
before the checker ran.

The arm that was dark is the one covering the SHIPPED lowering —
statepoints are the default on aarch64 and x86-64 — while its green
sibling covers the shadow frame. The gate looked like it was watching
the default configuration and was watching nothing.

Matches the sibling exactly: setup-node@v7 pinned by .node-version,
`npm ci --ignore-scripts --no-audit --no-fund`.

Co-authored-by: Ralph Küpper <ralph@skelpo.com>

Author: proggeramlug

.github/workflows/gc-root-dominance.yml

@@ -473,6 +473,20 @@ jobs:
       - name: Immovable-source exemptions must still hold
         run: python3 scripts/gc_root_dominance_check.py --audit-immovable-sources
 
+      # #8170: the dependency-scale corpus this job runs (added by #8084)
+      # compiles `node_modules/zod`, so it needs the same node setup its
+      # sibling job has. Without these two steps the job dies in setup with
+      # "node_modules/zod/src/index.ts is missing" and never reaches the
+      # checker — which meant the arm covering the SHIPPED lowering
+      # (statepoints are the default on aarch64 and x86-64) reported nothing
+      # at all, while its shadow-frame sibling stayed green and made the gate
+      # look healthy.
+      - uses: actions/setup-node@v7
+        with:
+          node-version-file: .node-version
+      - name: Install the npm dependencies the dep corpus compiles
+        run: npm ci --ignore-scripts --no-audit --no-fund
+
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
       # This also puts a matched LLVM 22 `opt` on disk and exports

changelog.d/8170-statepoints-npm-ci.md

@@ -0,0 +1,21 @@
+### Fixed
+
+- **`gc-root-dominance-statepoints` could not run its checker at all**, and had
+  failed on every `main` run and every PR since #8084 merged, with
+  `node_modules/zod/src/index.ts is missing; run npm ci --ignore-scripts`.
+
+  #8084 added the dependency-scale native corpus to the **statepoints** job.
+  That corpus compiles `node_modules/zod`, but the `actions/setup-node` and
+  `npm ci` steps that provide it lived only in the sibling `gc-root-dominance`
+  job. The statepoints job therefore died during setup, before the root-store
+  dominance checker ran.
+
+  This is worse than a red X. The statepoints arm is the one covering the
+  **shipped** lowering — RS4GC statepoints are the default on aarch64 and
+  x86-64 — while the green sibling covers the shadow-frame arm. So for a day
+  the gate looked like it was watching the default configuration and was
+  watching nothing, and it red-lighted every open PR, which trains reviewers
+  to ignore it. CLAUDE.md's hazards 2 and 4 at once.
+
+  The job now installs node the same way its sibling does, pinned by
+  `.node-version`, with `--ignore-scripts` for the same reason.