npm ci in the publish workflow requires the lockfile to satisfy the bumped package.json ranges.