chore: use lockfiles for NPM dependencies

[daniel-graham-amplitude]

Applies the equivalent of amplitude/Amplitude-Swift#350 in this repository.

Changes

• switch release workflow from inline npx -p ... installs to lockfile-based commands
• run npm ci before semantic-release in dry-run and release steps
• run semantic-release via npm exec
• add root package.json + package-lock.json for deterministic dependency resolution
• ignore node_modules/ in .gitignore where needed

[Copilot]

Pull request overview

This PR introduces lockfile-based Node tooling to make the repository’s semantic-release execution in GitHub Actions deterministic, replacing ad-hoc npx -p ... installs.

Changes:

• Adds a root package.json to declare the semantic-release toolchain and supporting plugins.
• Updates the release workflow to run npm ci and execute semantic-release via npm exec.
• Ignores node_modules/ in .gitignore.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated 3 comments.

File	Description
package.json	Introduces Node dependencies intended for the release workflow tooling.
.gitignore	Adds node_modules/ to avoid committing installed artifacts.
.github/workflows/release.yml	Switches semantic-release invocation to lockfile-based install (npm ci) + npm exec.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.