fix: lock file lag with validation and pre-commit note

[lee-chase]

The package.json seems to get updated often without the lock file. This should prevent that.

[bogy0]

As we discussed today governance meeting we should do the following:

• in package.json we should set packageManager value to pin the npm version based on the .nvmrc file:
  • "packageManager": "npm@11.11.0",
• Node version remains controlled via .nvmrc.
• Team workflow, maybe we can create a CONTRIBUTING.md where we state this:
  • Run nvm install once to install the .nvmrc version if missing.
  • Run nvm use in the repo before running npm commands.
  • Use npm ci for normal local setup and CI.
  • Use npm install only when intentionally adding/updating dependencies.
  • If package.json changes, commit package-lock.json changes in the same PR.

[lee-chase]

@rodet @bogy0

Made the change to package.json.

Added docs/CONTRIBUTING.md

NOTE: Carbon puts CONRIBUTING.md in the .github folder, but this feels a bit hidden to me.