Freeze the linter via lockfile and ignore vendored trees

- Move the markdownlint-cli2 pin into package.json + package-lock.json
  and run `npm ci` in CI: a bare `npx <pkg>@<version>` still resolves
  deep transitive deps fresh on every run, while the lockfile freezes
  the whole tree and makes the pin visible to update tooling.
- Add `ignores` for .terraform/ and node_modules/: markdownlint-cli2
  has no default exclusions, and `terraform init` vendors registry
  modules whose READMEs would fail local runs.
- Ignore node_modules in .gitignore.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: sir-sigurd

.github/workflows/ci.yml

@@ -23,10 +23,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      # Globs and rules come from .markdownlint-cli2.yaml. The version is pinned
-      # so a new markdownlint release can't change rules and break CI without a
-      # repo change; bump it deliberately.
-      - run: npx --yes markdownlint-cli2@0.22.1
+      # Globs and rules come from .markdownlint-cli2.yaml. npm ci installs the
+      # exact tree from package-lock.json, so no markdownlint (or transitive)
+      # release can change rules or break CI without a repo change; bump the
+      # version deliberately via package.json.
+      - run: npm ci
+      - run: npx --no-install markdownlint-cli2
 
   validate:
     runs-on: ubuntu-latest

.gitignore

@@ -2,3 +2,4 @@
 .terraform
 .terraform.lock.hcl
 tfplan
+node_modules

.markdownlint-cli2.yaml

@@ -18,3 +18,9 @@ config:
 # truth for which files are linted.
 globs:
   - "**/*.{md,markdown}"
+# markdownlint-cli2 has no default exclusions, so vendored trees must be
+# ignored explicitly: `terraform init` vendors registry modules (and their
+# READMEs) under .terraform/, and npm installs under node_modules/.
+ignores:
+  - "**/.terraform/**"
+  - "**/node_modules/**"