Enforce npm ci to prevent package-lock.json churn from peer dependencies

[Copilot]

The package-lock.json file was toggling "peer": true properties across environments. Root cause: npm 7+ adds these markers for unsatisfied peer dependencies (e.g., react from @vscode/webview-ui-toolkit), and npm install modifies the lockfile even without package.json changes.

Changes

• Added .npmrc: Documents npm configuration (save-exact=true, peer dependency handling)
• Updated CONTRIBUTING.md: Added NPM dependency management section
  • Enforces npm ci for routine development (doesn't modify lockfile)
  • Reserves npm install for intentional dependency changes only
  • Explains "peer": true behavior in lockfile
• Updated .devcontainer/devcontainer.json: Changed postCreateCommand from npm install to npm ci

Why npm ci

# npm ci: Clean install from lockfile (no modifications)
npm ci

# npm install: May update lockfile even without changes
npm install  # Only for adding/updating dependencies

CI/CD already uses npm ci exclusively. This change aligns local development with production builds.

Original prompt

Check the npm setup for the extension. I see us toggling the package-lock.json file continously between adding "peer": true, and then removing it again, depending on where we run it. I want some consitency in this and either document we do not use it, or enforce it being used always.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.