fix: relax npm engine enforcement in reusable build

[vitormattos]

Summary

Fix the real consumer regression found while validating npm-build in LibreCodeCoop/extract#154.

The reusable workflow selected Node ^22 from the project's own package.json, but enabling npm engine-strict caused npm ci to reject @nextcloud/axios@2.5.1, whose package metadata still declares Node ^20.

That is stricter than the previous workflow behavior and turns stale/transitive engine metadata into a build blocker.

Change

• keep selecting Node from the project's declared engine;
• keep using the npm bundled with that Node runtime;
• keep avoiding installation of a PR-controlled npm range;
• keep the pinned lockfile validation helper;
• remove global engine-strict enforcement;
• update the caller pin to immutable commit d96f4b5dcf780dea20d8843f54c4b52207dc25fd.

This preserves the supply-chain improvement without introducing a compatibility regression.