[botandbang]

Adds a lockfile so every install resolves to the same versions, and switches CI to npm ci so it installs exactly what's committed.

Added

• package-lock.json (lockfile version 3), generated by npm 11.19.1 under the .npmrc from build: harden the npm config with @lavamoat/harden #140, so it already respects the 3-day release age gate. Every registry package has a resolved URL and an integrity hash, and the platform packages for Linux and Windows (oxlint, oxfmt, docov) are included along with macOS's. With resolved URLs in the lockfile, the pinned allowScripts entry (fsevents@2.3.3: false) still matches and nothing is left pending.
• package-lock.json in the path filters of ci.yml's shared group and docs.yml, so a lockfile-only change (a Dependabot bump, say) runs the tests and the docs build.

Changed

• Every CI install uses npm ci with the same workspace flags as before: npm ci --workspaces=false in the lint and docs jobs, npm ci in the types job and the nightly build, and npm ci -w "$PACKAGE" in the test matrix. The nightly data PR can no longer pick up a regenerated lockfile, since npm ci doesn't write one.
• setup-node's npm cache stays off, but the comments now give the reasons that still hold with a lockfile: npm ci takes seconds in ci.yml, and the docs deploy and the nightly data PR shouldn't restore a shared cache.
• release.yml's pack job comment no longer says the repo has no lockfile. The job still skips uppt/pack's install, because no published package has a prepack or prepare script.

Removed

• package-lock=false from .npmrc.
• The test job's npm install -g npm step. It installed the newest npm outside any lockfile, so each matrix entry now uses the npm its Node version ships with (11.20.0 on Node 26, 11.19.1 on Node 24), both new enough for devEngines.
• .github/zizmor.yml, which only turned off zizmor's adhoc-packages audit because nothing had a lockfile. With npm ci everywhere and the global npm install gone, that audit now runs and reports nothing.

Checks

All run locally after deleting every node_modules:

• Node 24.22.2 / npm 11.19.1: npm ci, npm run lint (including the 4 lint:harden tests), npm run types (no diff), npm test and npm run coverage (182 tests each run, 0 failures, 100% coverage in every package), npm run docs, npm run build -w static, and npm pack -w core -w static --dry-run.
• Node 26.13.0 / npm 11.20.0: npm ci --workspaces=false then npm run lint, as the lint job does, and npm ci -w translate then npm run coverage -w translate, as a test job does.
• npm 12.2.2: npm ci -w translate and npm run coverage -w translate.
• npm install after npm ci leaves package-lock.json byte for byte the same.
• zizmor --offline .github/workflows with the audit back on: no findings.