actor-typeahead renders inside the sign-in form, in the popup, with the privileges of an extension page — the highest-leverage third-party surface the extension has, on a 0.x line that can change shape between patch releases. The lockfile already pins what a release installs, since deploy-ext.sh runs npm ci; this covers the other half, so a bare npm install cannot move it without someone deciding to. A test keeps the range exact, because `npm install --save` would quietly write a caret back.