Claude Code keeps rewriting package-lock.json
Every session that touches a dependency ends with a 3,000-line package-lock.json diff, even when I asked for a one-line version bump. Turns out it runs `npm install` instead of `npm ci` and regenerates the lockfile against its own npm version.