ci: tighten install-path comments

Collapse the worked-example narrative to one-line WHYs. Code is
unchanged.

.github/workflows/release-desktop.yml

@@ -443,16 +443,10 @@ jobs:
 
       - name: Install frontend dependencies
         working-directory: studio/frontend
-        # `npm ci` so a release build can never pull a fresh minor/patch
-        # of a transitive dep from the registry via caret-range resolution;
-        # the tree is exactly what the committed lockfile pins.
-        #
-        # Lifecycle scripts (esbuild native-binary postinstall, etc.) are
-        # required for `vite build`. The pre-install lockfile structural
-        # audit (lockfile_supply_chain_audit.py) is the practical defence
-        # against the npm postinstall-dropper class -- it fires BEFORE any
-        # tarball runs, on the injection pattern itself rather than an
-        # advisory-DB lookup.
+        # npm ci: release build installs exactly what the lockfile pins.
+        # Lifecycle scripts (esbuild native-binary postinstall) are required
+        # for vite build; lockfile_supply_chain_audit.py runs pre-install as
+        # the defence against the postinstall-dropper class.
         run: npm ci --no-fund --no-audit
 
       # ── Rust ──