chore: restore the lockfile entries CI's npm expects
ci: publish to npm without provenance, which self-hosted runners cann… …ot attest