fix: regenerate lockfile + add .npmrc to fix CI 403 on zwitch

- Deleted stale package-lock.json and ran npm install fresh — old lockfile
  had stale resolution metadata for zwitch@2.0.4 and other transitive deps
  that GitHub Actions npm registry was rejecting with 403
- Added .npmrc pinning public registry explicitly to prevent setup-node
  from forwarding any auth token to npmjs.org (common cause of 403s)

Author: sagarDeepakDevOps

.npmrc

@@ -0,0 +1,3 @@
+# Public registry — no auth token forwarded (prevents spurious 403s on CI)
+registry=https://registry.npmjs.org/
+legacy-peer-deps=false