fix package-lock

There is a change somewhere in npm v11.6.2 (which is used in our release workflow) which is more strict about optionalDependencies being listed in package-lock.json (they should be in package-lock but not installed to disk)

Author: gmaclennan