chore: keep lockfile registry-agnostic

[peakematt]

HELP-722 requires committed public SDK lockfiles to be independent of the registry used to generate them. The current lockfile records registry-specific resolved URLs, which couples it to the effective install registry.

This adds omit-lockfile-registry-resolved=true and regenerates the existing lockfile without changing dependencies.

Verification found 593 registry resolved entries removed and all 593 integrity values preserved. Versions, package records, dependency relationships, non-registry resolutions, and lockfile version are unchanged. There are zero Socket Firewall host references and zero semantic verifier violations.

The branch was regenerated and checked with Node v22.23.2 and npm 10.9.8:

npm install --package-lock-only --ignore-scripts --no-audit --no-fund
npm ci --registry=https://registry.npmjs.org/
npm run prettier
npm run lint
npm run build
npm test -- --coverage

The clean public-registry install left the lockfile unchanged. This draft should remain unmerged until the earlier workos-node rollout and downstream lockfile-command validation are complete; no reviewer action is requested yet.

HELP-722: https://linear.app/workos/issue/HELP-722

[linear-code]

HELP-722

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[greptile-apps]

Greptile Summary

This PR makes the committed npm lockfile registry-agnostic without changing dependency resolution.

• Adds omit-lockfile-registry-resolved=true to the repository npm configuration.
• Removes registry-specific resolved URLs while retaining package versions, relationships, and integrity hashes.

Confidence Score: 5/5

The PR appears safe to merge because the supported npm workflows can consume the registry-agnostic lockfile without changing dependency semantics.

The configuration is supported by the npm versions used in repository workflows, and the lockfile change only removes registry-specific URL metadata while preserving versions, dependency relationships, and integrity hashes.

Important Files Changed

Filename	Overview
.npmrc	Adds the npm setting that prevents registry-specific tarball URLs from being written to lockfiles.
package-lock.json	Removes registry resolved fields while preserving the dependency graph and integrity metadata.

_{Reviews (1): Last reviewed commit: "chore: keep lockfile registry-agnostic" | Re-trigger Greptile}