chore(cli): stop tracking package-lock.json

package-lock.json should not be version-controlled for the CLI package.
git rm --cached it (worktree copy retained), ignore it in .gitignore,
and switch CI from npm ci to npm install since the lock file is no
longer present in the repository.

Author: jygzyc

.github/workflows/build-cli.yml

@@ -35,11 +35,9 @@ jobs:
     - uses: actions/setup-node@v7
       with:
         node-version: '22'
-        cache: 'npm'
-        cache-dependency-path: decx-cli/package-lock.json
 
     - name: Install dependencies
-      run: npm ci
+      run: npm install
 
     - name: Type check
       run: npm run typecheck

.gitignore

@@ -76,3 +76,4 @@ CLAUDE.md
 .omo
 .env
 .zcode/
+decx-cli/package-lock.json