Use npm ci for reproducible installs

## Summary
- commit package-lock.json for reproducible development dependency resolution
- switch CI dependency installation to npm ci
- allow package-lock.json to be tracked

## Verification
- npm ci
- npm run typecheck
- npm test
- npm pack --dry-run

Author: justjavac

.github/workflows/ci.yml

@@ -33,7 +33,7 @@ jobs:
           node-version: ${{ matrix.node-version }}
 
       - name: Install dependencies
-        run: npm install --no-package-lock
+        run: npm ci
 
       - name: Typecheck
         run: npm run typecheck

.gitignore

@@ -2,4 +2,3 @@ node_modules/
 dist/
 dist-scripts/
 npm-debug.log*
-package-lock.json