The Woodpecker pipeline runs `npm ci` which requires a lockfile; without it the install step errors with EUSAGE.