Generated Dockerfile uses npm ci without package-lock.json

Found this in my local testing and at least one nightly runs. The LLM generated Docker file uses npm ci but doesn't copy a package-lock file. `npm ci` requires a package-lock, without it, the agent will waste one turn.

https://agreeable-dune-0f718070f.1.azurestaticapps.net/nightly-runs.html?file=2026-05-08%2F25545621913%2Fazure-deploy%2Fterraform-app-service-deploy%2Fazure-deploy_-_Integration_Tests_terraform-app-service-deploy_creates_todo_list_with_frontend_and_API_using_Terraform%2Fagent-metadata-2026-05-08T09-52-41-642Z.md

Start by inspecting the generated Dockerfile from the linked nightly run and tracing the template or generation entry point that adds `npm ci`. Confirm how package-lock files are handled, then verify that generated Dockerfiles provide the lockfile required by `npm ci` and rerun the relevant nightly or integration test.

Written by the indexing model from the issue text.