ci: use npm ci with ignored scripts

[noritaka1166]

Summary

This updates the publish workflow to make dependency installation more deterministic and reduce lifecycle script execution during CI.

• Use npm ci --ignore-scripts instead of npm install in the test job
• Keep npm ci --ignore-scripts in the publish job
• Explicitly rebuild duckdb in the test job because its native binding is required by the existing csv-issues-esm tests

Why

Running npm install commands without --ignore-scripts can execute package lifecycle scripts. Using npm ci --ignore-scripts limits that behavior and keeps CI installs locked to package-lock.json.

The test suite still needs duckdb/lib/binding/duckdb.node for demo/issues-esm/lib/441.js, so this PR allows only that required native build step explicitly with npm rebuild duckdb.

[wdavidw]

I don't see what this is trying to fix considering the we don't have error in the CI. Also, this belongs to the issue-esm json package file and should be isolated inside a separated commit.