fix: Dual package managers: both package-lock.json and yarn.lock tracked (#343)

Remove kraiken-lib/yarn.lock (npm is the sole package manager per CI and
build scripts), add packageManager field to kraiken-lib/package.json to
make the intent explicit, and add a single-package-manager CI step that
fails the build if yarn.lock reappears in kraiken-lib/.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.woodpecker/ci.yml

@@ -56,6 +56,18 @@ steps:
   # NOTE: contracts-base-sepolia step removed — requires base_sepolia_rpc secret
   # which is not configured. Re-add when RPC secret is provisioned.
 
+  - name: single-package-manager
+    image: registry.niovi.voyage/harb/node-ci:latest
+    commands:
+      - |
+        bash -c '
+          set -euo pipefail
+          if [ -f kraiken-lib/yarn.lock ]; then
+            echo "ERROR: kraiken-lib/yarn.lock must not be committed. Use npm only (see packageManager field in kraiken-lib/package.json)." >&2
+            exit 1
+          fi
+        '
+
   - name: node-quality
     image: registry.niovi.voyage/harb/node-ci:latest
     environment: