test: pin the TypeScript test runner instead of downloading it at runtime

[appergb]

Audit finding

check:hotkey-side-modifiers runs npx tsx ..., but tsx is not a direct devDependency and no local binary exists after npm ci. The check therefore downloads the current registry version during execution, bypassing the project lockfile and making offline/CI runs non-reproducible. The tsx entry currently visible in package-lock.json is only Vite optional peer metadata, not an installed dependency.

Acceptance criteria

• Add tsx as a pinned/locked devDependency and invoke the local npm-script binary.
• The check works after a clean npm ci with network disabled for the test command.
• Existing frontend tests/build pass.
• No product/UI behavior change.