drop the unread npm lockfile, bun.lock is the CLI's (#10580)

* fix(cli): sync package-lock.json with package.json

`npm ci` fails in cli/ because the lockfile predates two manifest changes:
windmill-parser-wasm-yaml was bumped to 1.770.0 and windmill-yaml-validator
1.1.1 was added, neither of which reached the lockfile.

Regenerated with `npm install --package-lock-only`; the only entries touched
are those two packages and windmill-yaml-validator's transitive deps.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(cli): drop the unread npm lockfile, bun.lock is the CLI's

Every install path in cli/ runs `bun install`: cli-tests.yml, git-sync-test.yml,
backend-test.yml, build.sh, and install_dev.sh (its --node branch installs the
generated npm/ bundle, which carries its own manifest). build-npm.ts synthesises
the published package.json from scratch, and change-versions.sh regenerates the
frontend and yaml-validator lockfiles but not this one.

So package-lock.json was read by nothing and verified by nothing, and drifted out
of sync with package.json unnoticed until `npm ci` refused to install. Deleting it
removes the second source of truth rather than hand-repairing it again on the next
bun-driven dependency change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

cli/.gitignore

@@ -1,4 +1,8 @@
 npm/
 gen/
 node_modules/
-windmill-utils-internal/.npmrc
+windmill-utils-internal/.npmrc
+
+# bun.lock is the CLI's lockfile: every install path here (CI, build.sh, install_dev.sh)
+# runs `bun install`. A committed npm lockfile is read by nothing and goes stale unnoticed.
+package-lock.json