npm ci requires a lockfile — commit it for reproducible builds. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>