fix(ci): dompurify override and a listing-order-dependent walk test

The dompurify override now follows the direct dependency ("$dompurify");
npm refuses an override whose spec differs from a direct dependency's,
which broke `npm ci`.

The follow_root cycle test sorted nothing and assumed APFS's sorted
listing order; on ext4 the children come back hashed.

Author: tibordp

libs/newt-common/src/vfs/walk.rs

@@ -942,6 +942,9 @@ mod tests {
         walk(&vfs, std::slice::from_ref(&root), &options, &mut log)
             .await
             .unwrap();
+        // Children come in the filesystem's listing order (hashed on ext4).
+        let children = log.lines.len() - 1;
+        log.lines[1..children].sort();
         let root = root.as_wire_str();
         assert_eq!(
             log.lines,

package.json

@@ -78,6 +78,6 @@
     ]
   },
   "overrides": {
-    "dompurify": "^3.4.12"
+    "dompurify": "$dompurify"
   }
 }