chore: add packages/cli/package-lock.json to .gitignore

[GreyC]

Problem

packages/cli/package-lock.json is untracked (generated by local npm install) but not gitignored. The repo uses pnpm-lock.yaml as the canonical lockfile.

Fix

Add packages/cli/package-lock.json to .gitignore.

Acceptance Criteria

• git status no longer shows packages/cli/package-lock.json as untracked