chore: use lockfiles for NPM dependencies

[daniel-graham-amplitude]

Applies the equivalent of amplitude/Amplitude-Swift#350 in this repository.

Changes

• switch release workflow from inline npx -p ... installs to lockfile-based commands
• run npm ci before semantic-release in dry-run and release steps
• run semantic-release via npm exec
• add root package.json + package-lock.json for deterministic dependency resolution
• ignore node_modules/ in .gitignore where needed

[Copilot]

Pull request overview

This PR updates the release workflow to use a committed npm lockfile (instead of npx -p ...) so semantic-release runs with deterministic dependency resolution.

Changes:

• Add root package.json / package-lock.json and update release workflow to run npm ci + npm exec semantic-release.
• Update .gitignore to exclude node_modules/.
• Switch semantic-release execution from inline npx -p installs to local, lockfile-resolved tooling.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated 3 comments.

File	Description
package.json	Introduces pinned npm dependencies used by the release workflow.
package-lock.json	Locks the dependency graph for deterministic installs in CI (npm ci).
.gitignore	Ignores node_modules/ in the repo.
.github/workflows/release.yml	Runs npm ci before semantic-release and executes semantic-release via npm exec.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.