117873423b
Per feedback-no-local-runs we don't run npm locally, so no package-lock.json is tracked. npm ci fails without a lockfile; npm install works fine. We lose strict reproducibility, which is acceptable for a pre-v1 project — if we want it later, commit a package-lock.json and flip back to npm ci. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>