ci: enforce wix gateway proxy in all workflows

[dorraba]

What

Routes every npm-registry fetch in this repo's CI through the Wix npm embargo gateway — the same Shai-Hulud supply-chain protection already merged in base44-dev/apper#19112, base44-dev/vite-plugin#105, base44/cli#592, and the rest of the org rollout. All jobs run on ubuntu-latest, so the action, CA cert, and checker are ported byte-identical from vite-plugin/apper.

• .github/actions/wix-gateway-proxy (+ gateway CA cert): pins registry.npmjs.org to the gateway in /etc/hosts, trusts the gateway CA system-wide, exports NODE_EXTRA_CA_CERTS / DENO_TLS_CA_STORE.
• Injected as mandatory step 2 of all 10 jobs across 10 workflows — after each job's checkout, or after a sparse-checkout: .github bootstrap in manual-publish.yml (its token-generation step precedes its checkout).
• check-wix-proxy.yml + checker script + tests: CI fails if any job — present or future — skips the action. Verified locally: 10/10 jobs.
• wix-gateway-proxy-check.yml (manual dispatch) for connectivity debugging.

Why this repo

CI installs npm dependencies on every PR (lint, unit-tests, security-audit, preview-publish) and publishes the public @base44/sdk package with NPM_TOKEN — the package ships into every Base44 user app, the same profile that motivated the vite-plugin and cli ports.

Publish flows: both npm publish steps (manual-publish.yml, preview-publish.yml) are preceded by an Unpin npm registry for first-party publish step — the gateway refuses versions younger than its cooldown, including the version the job just built. All installs before it stay gatewayed.

Stays gatewayed by design: npm install -g npm@11 in both publish flows — if that npm release is younger than the cooldown the job fails until it ages, which is the embargo working as intended.

Watch item: security-audit.yml runs npm audit, which POSTs to the registry's bulk-advisory endpoint through the pinned gateway. If the gateway doesn't proxy that endpoint, the weekly audit will fail loudly — dispatch it once after merge to confirm.

Verification

• This PR's own CI (lint, unit-tests, security-audit, preview-publish) runs installs through the gateway
• Check Wix Gateway Proxy passes
• After merge: dispatch wix gateway proxy check, Security Audit, and Manual Package Publish with dry_run=true
• After merge: consider making Wix Gateway Proxy a required status check

---

🤖 Generated with Claude Code

[guyofeck]

Superseded by #248, which carries this commit unchanged plus a follow-up porting base44/cli#597.

The reason for rolling them together rather than stacking: the Unpin npm registry for first-party publish step here (sed -i /etc/hosts) is the thing secplatform decided against as a long-term solution — the gateway can't carry npm publish, so publish workflows are instead exempt from the gateway and protected by the lockfile plus min-release-age=14 in .npmrc. #248 records that exemption explicitly in check_wix_proxy_steps.py so every other workflow still fails CI without the proxy, switches preview-publish.yml to npm ci so the ungatewayed job resolves nothing, and drops npm install -g npm@11 (a floating fetch outside the cooldown) by moving both publish jobs to Node 24.

Thanks @dorraba — your gateway commit is unmodified in #248. GitHub won't let me add you as a reviewer (not a collaborator on this repo), so flagging it here: a look over #248 would be welcome.