c532f0a6a3
Packages the published npm tarball with a vendored lockfile since upstream ships none and its committed one lacks integrity hashes. devDependencies are stripped so `npm ci` stays in sync with the runtime-only lockfile.