The publish workflow bundles the Node api-server into the wheel by copying
index.js + package.json into datalex_core/_server/ and running npm ci. But
we weren't copying the lockfile — npm ci hard-requires one, so the v0.2.0
release build failed at the bundle step.

Fix: copy package-lock.json alongside the other two files; npm ci now has
what it needs. Lockfile is still removed after install so it doesn't ship
in the wheel.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>