chore: keep lockfile registry-agnostic

[peakematt]

HELP-722 requires committed public SDK lockfiles to be independent of the registry used to generate them. The current lockfile records registry-specific resolved URLs, which couples it to the effective install registry.

This adds omit-lockfile-registry-resolved=true and regenerates the existing lockfile without changing dependencies.

Verification found 593 registry resolved entries removed and all 593 integrity values preserved. Versions, package records, dependency relationships, non-registry resolutions, and lockfile version are unchanged. There are zero Socket Firewall host references and zero semantic verifier violations.

The branch was regenerated and checked with Node v22.23.2 and npm 10.9.8:

npm install --package-lock-only --ignore-scripts --no-audit --no-fund
npm ci --registry=https://registry.npmjs.org/
npm run prettier
npm run lint
npm run build
npm test -- --coverage

The clean public-registry install left the lockfile unchanged. This draft should remain unmerged until the earlier workos-node rollout and downstream lockfile-command validation are complete; no reviewer action is requested yet.

HELP-722: https://linear.app/workos/issue/HELP-722

[linear-code]

HELP-722

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge when its documented rollout dependency is complete.

Summary

• Adds omit-lockfile-registry-resolved=true to .npmrc.
• Removes registry-hosted resolved URLs while preserving dependency versions, integrity hashes, and package relationships.

_{Reviews (2) · Last reviewed commit: "chore: keep lockfile registry-agnostic"}