Replace pnpm-lock.yaml with package-lock.json. pnpm-workspace.yaml's
allowBuilds becomes package.json#allowScripts, which npm 11 gates the same way,
listing only the packages actually present in the tree.
Add a .gitignore: the repository had none, so nothing kept the installed
dependency tree out of version control.
