remove/disable package-lock.json from cli source

My PR is locked so cannot reopen @tibo-openai
https://github.com/openai/codex/pull/252

tldr; lockfiles guaranteed reproducibility only for maintainers, which can obscure breakages that happen on npm install by consumers

yep, it’s true that package-lock.json isn’t included in the publish. but that’s actually because npm hard-skips it, not due to the files list. it’s safe to rely on that behavior, even without "files".

the point though is not about publishing it, you can never publish it, but that your CI will be running w/ a lockfile that the consumer will never be protected by on install.

If there is a breakage in the dep tree, due to resolution that happens at install time like some package broke semver or something, your devs (or anyone building from source) will never see it due to them being shielded by the lockfile.

however consumers cannot be shielded by it, so they will install a broken release and you wont know about it until someone reports it

it's a "choose your pain" issue. the lockfile not being used or generated can break your CI or your devs. but that's acceptable pain to a maintainer, bc if you choose stable CI via lockfiles to protect yourselves, that very real breakage youve shielded yourself from will just break consumers when it happens. hence why libraries often eschew it, they take the pain instead