build lockfile #2043
Description
I spent some time diagnosing a bug on my dev machine but not appearing in production - on the same codebase.
It was because I don't commit src/.observablehq/cache (in JS fashion it's giant) and the fresh builds in CI have up-to-date & compatible codemirror dependencies that somehow went out of sync on my machine (relating to npm: resolutions: probably I need to get the message about using node:).
A lockfile would provide build consistency without committing the cache.
I guess this may go unfixed but... thanks for the epic project and followups!