chore(node): commit bindings/node/package-lock.json for reproducible installs (#68)

Until now `package-lock.json` was globally ignored. Two practical
consequences for the Node binding:

- A fresh `git clone && cd bindings/node && npm install` resolved
  `@napi-rs/cli` and any transitive deps to whatever the npm registry
  currently considered the latest matching the package.json semver
  ranges. Contributors could get different dep graphs on different days.
- No protection against transitive-dep tampering at install time
  (lockfile records resolved versions + integrity hashes, npm verifies
  on subsequent installs).

Drop the global `package-lock.json` ignore and commit the freshly
generated `bindings/node/package-lock.json` (140 lines, only a couple
of direct deps because the binding is small). The `.gitignore` comment
notes that we still don't expect lockfiles at the workspace root.

No CI workflow changes — the existing `npm install` in the Node-test job
will now consume the committed lockfile, which is exactly what we want.

.gitignore

@@ -46,7 +46,8 @@ tarpaulin-report.html
 bindings/node/*.node
 bindings/node/index.d.ts
 bindings/node/npm-debug.log*
-package-lock.json
+# package-lock.json is committed (under bindings/node/) so contributors
+# get reproducible npm installs. Top-level lockfiles still aren't expected.
 
 # WASM build output
 bindings/wasm/pkg/