GCP examples have no committed lockfiles, so prereleases are hard to install

pulumi/examples has exactly one committed package-lock.json, at the repo root. None of the 18 TypeScript GCP examples has one.

This surfaced while testing the pulumi-gcp v10 alpha. npm's min-release-age setting, increasingly common as supply-chain hardening, refuses to resolve a version published inside the configured window, so npm install @pulumi/gcp@10.0.0-alpha.1 fails with a confusing ETARGET that reads as though the package does not exist. Installing from a lockfile is not subject to that check, because the version is already resolved, so npm ci works where npm install does not.

Committed lockfiles would make the examples reproducible and would carry prerelease testers past this. The cost is 18 more files to maintain and more Renovate surface, and a stale lockfile can hand a newcomer an old dependency tree, which is presumably why the repo has avoided them. Filing so the trade-off is recorded rather than rediscovered.

Start by inspecting the 18 TypeScript GCP examples under pulumi/examples and compare their dependency setup with the single committed package-lock.json at the repository root. Reproduce the reported difference between npm install and npm ci with the pulumi-gcp v10 alpha and review the maintenance trade-offs. Done means the repository has a clear decision about whether and where lockfiles should be committed.