Pin E2E npm deps via committed lockfile (fixes CI 1.21.11 support)

The on-demand E2E run failed in CI with "Server version '1.21.11' is not
supported. Latest supported version is '1.21.4'." — without a committed
package-lock.json, CI's fresh npm install resolved an older
mineflayer/minecraft-data than the local run, and it didn't know 1.21.11.

Commit the lockfile (mineflayer 4.37.1 / minecraft-data 3.111.0, which
support 1.21.11) so installs are reproducible, and key the npm cache on
the lockfile (also invalidates the stale node_modules the failed run
cached under the package.json hash).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NKxodNE4h3TsSHMqDEeC8v

Author: tastybento

.github/workflows/e2e.yml

@@ -57,7 +57,9 @@ jobs:
         uses: actions/cache@v4
         with:
           path: e2e/src/test/e2e/node_modules
-          key: e2e-npm-${{ hashFiles('e2e/src/test/e2e/package.json') }}
+          # Key on the committed lockfile so the cache tracks the exact resolved versions
+          # (mineflayer/minecraft-data must support the target Minecraft version).
+          key: e2e-npm-${{ hashFiles('e2e/src/test/e2e/package-lock.json') }}
 
       - name: Build Challenges jar (Maven)
         run: mvn -B -DskipTests package

e2e/.gitignore

@@ -8,4 +8,5 @@ build/
 # Node / TypeScript test artifacts
 src/test/e2e/node_modules/
 src/test/e2e/dist/
-src/test/e2e/package-lock.json
+# package-lock.json IS committed — it pins mineflayer/minecraft-data to versions that
+# support the target Minecraft version, so CI installs are reproducible.