build: use version controlled lockfile of package dependencies for development

[zimeg]

Summary

This PR uses a version controlled lockfile of package dependencies for development to guard against drift and supply chain attacks, mirroring slackapi/node-slack-sdk#2551 🔏

Notes

• This lockfile is not included with published packages so we are not binding versions with this change:

package-lock.json cannot be published...

🔗 https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json

• Additionally, the files field in package.json is an allowlist that only includes dist/**/*
• CI workflows now use npm ci for deterministic installs from the lockfile

Requirements

• I've read and understood the Contributing Guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4705502

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.59%. Comparing base (29167c5) to head (4705502).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2876   +/-   ##
=======================================
  Coverage   93.59%   93.59%           
=======================================
  Files          44       44           
  Lines        7855     7855           
  Branches      687      687           
=======================================
  Hits         7352     7352           
  Misses        498      498           
  Partials        5        5           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[zimeg]

📣 note: For now the examples are unchanged but also inconsistent in which include a lockfile!

[zimeg]

🔬 Related discussion in slackapi/node-slack-sdk#2541!

[zimeg]

🗣️ Adjacent packages published without the lockfile causing issue so I will merge this now but remain diligent next release.