fix: install hwlab render deps in temp clone

scripts/hwlab-g14-contract-test.ts

@@ -266,8 +266,10 @@ const sourceText = await Bun.file(new URL("./src/hwlab-g14.ts", import.meta.url)
 assertCondition(
   renderScript.includes("git clone --shared --no-checkout \"$cicd_repo\" \"$worktree_dir\"")
     && renderScript.includes("git -C \"$worktree_dir\" checkout --detach \"$source_commit\"")
+    && renderScript.includes("npm ci --ignore-scripts --no-audit --prefer-offline")
+    && renderScript.includes("bun install --frozen-lockfile --ignore-scripts")
     && renderScript.includes("/tmp/hwlab-v02-control-plane-source-aaaaaaaaaaaa-"),
-  "v0.2 control-plane render must use an isolated temp clone from the CI/CD repo so same-commit concurrent triggers do not share worktree metadata",
+  "v0.2 control-plane render must use an isolated temp clone with lockfile-based dependencies so same-commit concurrent triggers do not share worktree metadata",
   renderScript,
 );
 assertCondition(

scripts/src/hwlab-g14.ts

@@ -2813,6 +2813,16 @@ export function v02ControlPlaneRenderScript(sourceCommit: string, token = v02Ren
     "git -C \"$worktree_dir\" checkout --detach \"$source_commit\"",
     "test \"$(git -C \"$worktree_dir\" rev-parse HEAD)\" = \"$source_commit\"",
     "cd \"$worktree_dir\"",
+    "if [ ! -d node_modules/yaml ]; then",
+    "  if [ -f package-lock.json ]; then",
+    "    npm ci --ignore-scripts --no-audit --prefer-offline",
+    "  elif [ -f bun.lock ] || [ -f bun.lockb ]; then",
+    "    bun install --frozen-lockfile --ignore-scripts",
+    "  else",
+    "    echo \"v0.2 control-plane render cannot install dependencies: no lockfile found\" >&2",
+    "    exit 42",
+    "  fi",
+    "fi",
     `node scripts/g14-gitops-render.mjs --lane v02 --source-revision ${shellQuote(sourceCommit)} --out "$render_dir"`,
   ].join("\n");
 }