benchmarks/pulumi/package-lock.json: the directory is used with bun (bun.lockb); no workflow,
Dockerfile or script installs from this lockfile.
rust-client/Cargo.lock: library crate whose Cargo.toml is generated by dev.nu; the lockfile is
not consumed by downstream crates.io users and was stale (pinned 1.518.2). Ignored from now on.
Both only generated Dependabot alerts about dependency trees that never ship.
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>