Speed up OpenUI CLI dependency installs

[zahlekhan]

Summary

• ship npm lockfiles with both CLI templates and use npm ci --prefer-offline --no-audit --no-fund --progress=false
• pin the published OpenUI template dependencies instead of resolving latest during every scaffold
• keep copied lockfile root metadata aligned with the generated project name and rewritten dependencies
• bump @openuidev/cli from 0.1.7 to 0.1.8

Why

The npm scaffold path currently starts from an unlocked manifest, resolves several latest dependencies, performs an audit, and writes a new lockfile. That makes fresh installs materially slower than necessary and allows generated dependency trees to drift independently of the CLI release.

The updated path installs a release-tested, deterministic tree. Install-time auditing is skipped for speed; users can still run npm audit explicitly.

Benchmarks

Before/after npm timings used fresh template copies. Cold runs used empty isolated npm caches; warm runs used populated caches with fresh project directories.

Template	Cache	Before	After	Improvement
Self-hosted	Cold	33.87s	6.63s	80.4% faster
Self-hosted	Warm	9.32s	7.09s	23.9% faster
Cloud	Cold	45.82s	8.26s	82.0% faster
Cloud	Warm	13.33s	6.77s	49.2% faster

An additional cold comparison used the updated templates, Node 24.2.0, npm 11.3.0, pnpm 10.33.0, and separate empty npm caches/pnpm stores:

Template	npm	pnpm	Result
Self-hosted	6.13s	11.03s	npm 44.4% faster
Cloud	7.71s	13.88s	npm 44.5% faster

These are single-run local measurements, so cold network timing can vary.

Validation

• pnpm --filter @openuidev/cli build
• pnpm --filter @openuidev/cli lint:check
• pnpm --filter @openuidev/cli format:check
• npm-only end-to-end CLI scaffold
• generated self-hosted Next.js production build
• package manifest/lockfile consistency checks
• npm pack --dry-run --ignore-scripts (220.3 kB package tarball)