Refresh package-lock.json so npm ci resolves envsitter 0.1.0 from the registry (integrity matches the published tarball), which fixes CI's ETARGET failure.