LTS-3294: complete .npmrc hardening + pin SDK to the Playwright pod version

- .npmrc: add ignore-scripts=true + engine-strict=true -> all 6 SC-12282
  directives now present (access=restricted is N/A for a public sample).
- package.json: pin browserstack-node-sdk to 1.60.1 -- the version the Playwright
  BLU runner enforces in prod (docker-selenium/Playwright/download-test.js
  SDK_VERSION on lts-main) -- and drop the postinstall `npm update
  browserstack-node-sdk` that was the only reason install-scripts were needed
  (this unblocks ignore-scripts). Add engines.node ">=18" (satisfied by the
  runner pods and required by Playwright + the SDK) so engine-strict has a safe
  floor that only rejects EOL Node.
- package-lock.json: regenerated for 1.60.1, kept lockfileVersion 2.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: amitsi-bs

.npmrc

@@ -4,16 +4,20 @@
 # access=restricted is intentionally OMITTED — this is a public, customer-facing
 # sample repository, not a published private package.
 #
-# ignore-scripts=true is intentionally DEFERRED. This repo ships its own
-# postinstall (`npm update browserstack-node-sdk`) so the sample always runs the
-# latest SDK; enabling ignore-scripts would silently disable it. Re-enable once
-# the sample pins the SDK and drops the postinstall.
+# ignore-scripts=true is now safe: browserstack-node-sdk is pinned directly in
+# package.json to 1.60.1 — the version the Playwright BLU runner enforces in prod
+# (docker-selenium/Playwright/download-test.js SDK_VERSION on lts-main) — so the old
+# `postinstall: npm update browserstack-node-sdk` (the only install-script this
+# sample needed) has been removed.
 #
-# engine-strict=true is intentionally DEFERRED. Customers clone and run this
-# sample on a wide range of Node versions; hard EBADENGINE enforcement on
-# transitive deps would break `npm install` for them. Kept as a warning.
+# engine-strict=true enforces the package.json `engines.node` floor (>=18), which
+# matches the Node version in our runner pod and what Playwright + the SDK already
+# require. Customers on EOL Node (<18) get a clear upgrade message instead of an
+# obscure runtime failure.
 
 strict-ssl=true
 save-exact=true
 audit-level=high
 legacy-peer-deps=false
+ignore-scripts=true
+engine-strict=true