Lockfile

Lockfiles Explained: npm ci and pnpm Frozen Installs

Commit the lockfile and use npm ci or pnpm --frozen-lockfile in CI so package manifests cannot silently resolve a different dependency tree.