fix(tools): use npmjs.org registry in package-lock.json

Regenerate package-lock.json with registry.npmjs.org so the release
metadata test does not match the forbidden registry.npmmirror pattern.
The previous install used the local npmmirror registry, which rewrote
existing resolved URLs and broke test/plugins/plugin-manifests.test.mjs.

Co-authored-by: QoderAI (Qwen 3.8 Max) <qoder_ai@qoder.com>

Author: phodal