npm ci in CI requires package-lock.json, so stop ignoring it; it pins CI
and contributor installs only, consumers never see it.
publish.yml now maps release channels to npm dist-tags: latest, beta,
alpha (from the version suffix of a GitHub release) and dev (manual runs
stamp a unique 0.x.y-dev.N version per build). Publishing a prerelease
version to latest fails loud.
