Eliminate npm lockfiles estate-wide (npm-avoidant)

[hyperpolymath]

Scope: no tracked package-lock.json anywhere in the estate; npm-avoidant codified.

Mechanism: add package-lock.json to canonical .gitignore in rsr-template-repo + v3-templater, propagate to consumers, gitbot rejects re-introduction. docs/JS-RUNTIME-POLICY.adoc references purge-node-modules.sh.

Acceptance: 0 tracked package-lock.json estate-wide; template .gitignore covers it; enforcement wired.

Parent: #66

[hyperpolymath]

Template-side already satisfied: rsr-template-repo/.gitignore and v3-templater/.gitignore both carry package-lock.json and **/package-lock.json. Remaining work is estate-wide propagation + gitbot reject-on-reintroduction (epic-ongoing). Refs #66.