build lockfile

I spent some time diagnosing a bug on my dev machine but not appearing in production - on the same codebase. It was because I don't commit `src/.observablehq/cache` (in JS fashion it's giant) and the fresh builds in CI have up-to-date & compatible codemirror dependencies that somehow went out of sync on my machine (relating to `npm:` resolutions). A lockfile would provide build consistency without committing the cache. I guess this may go unfixed but... thanks for the epic project and followups!