chore: standardise website/ on npm and delete the duplicate lockfiles

[Kshot3000]

Fixes #337 — standardises website/ on npm and deletes the duplicate lockfiles.

What changed

• Deleted website/yarn.lock and the stray root package-lock.json (an empty packages: {} lock with no matching manifest). website/package-lock.json is now the only tracked lockfile — the one CI actually installs from. This is the duplication that double-counted the braces advisory as alerts 259 + 260 and produced the false node-forge alert 261 from a lockfile CI never installs; both should close on the post-merge Dependabot scan.
• website/package.json: removed the "packageManager": "yarn@…" declaration and the yarn-only resolutions block. Nothing is lost: I verified resolutions and the npm overrides block are identical — same 32 pins, key for key — before deleting.
• Docs describe npm only:
  • website/README.md — npm install, npm run start:dev (with a note that npm start is a full production build + serve, not the dev server), npm run build, npm run audit. The deployment section no longer tells contributors to yarn deploy to gh-pages by hand; it points at the deploy workflow that runs on push to main.
  • CONTRIBUTING.md — prerequisites are npm (not "npm or yarn"), and the local-server step is npm run start:dev.
  • website/SECURITY.md — one line in the same spirit: commit package.json and package-lock.json together (it previously told contributors to commit yarn.lock too, which would reintroduce the duplicate).
• Guard against regression: pr-build-website.yml gains a step that fails the PR build if any tracked yarn.lock / pnpm-lock.yaml, or a root package-lock.json, exists — and the workflow's path triggers now include lockfile paths outside website/** so a root-level lockfile PR runs the gate too.

Verification

• Guard tested both ways locally against the index: clean tree → no extra lockfiles (pass); website/yarn.lock force-added back → guard reports it (fail).
• website/package.json parses as valid JSON after the deletions; the diff is deletions-only there (35 lines).
• The workflow file parses as valid YAML.
• The website build itself runs in this PR's own pr-build-website check (npm ci + npm run build from the surviving lockfile).

Notes

• This PR and chore: pin the Node version for contributors #342 both touch CONTRIBUTING.md, in adjacent lines (mine: the package-manager prerequisite and the start command; chore: pin the Node version for contributors #342: the Node version line). If chore: pin the Node version for contributors #342 merges first, this branch may need a trivial rebase — happy to do it.
• Left untouched, deliberately: the historical CHANGELOG/blog yarn mentions, and .agents/skills/harun-review/SKILL.md, which still describes yarn as the source of truth — that one reads like a maintainer-owned review skill, so flagging it here rather than rewriting it in this PR.

---

Built as an independent Cardano community contributor — not affiliated with the Cardano Foundation, IOG or Intersect.

@Kshot9000 · https://x.com/kshot9000
ADA: addr1q8hnl6vl5a6k3rw3n5g3jtte696zcl76kfatzv7gpswa9r0dj7fma6klq55y4ffm7tf0em09udnyhuk4ah92pl5x9jpqjae44v

cc @cardano-foundation @IntersectMBO

[Kshot3000]

Rebased onto main now that #342 has merged — the one conflict was in CONTRIBUTING.md (adjacent prerequisite lines) and is resolved keeping both changes: the Node 22 / .nvmrc prerequisite from #342 and this PR's npm-only wording. Head is now 4e58a7d; the PR is mergeable again.

[IanoNjuguna]

Hey Kyle, Going to review this before merging.

[Kshot3000]

Sounds good

…

On Sun, Oct 18, 2026, 10:45 AM Ian Njuguna ***@***.***> wrote: *IanoNjuguna* left a comment (IntersectMBO/developer-experience#365) <#365 (comment)> Hey Kyle, Going to review this before merging. — Reply to this email directly, view it on GitHub <#365?email_source=notifications&email_token=CMAPYQEHLBRLGQNUR3VFFX35UTQQBA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMRVGE4DIOJSG432M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-6251849277>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/CMAPYQCL5JVWHY5JSMC3IPT5UTQQBAVCNFSNUABFKJSXA33TNF2G64TZHM4TANBYGUZDOOJWHNEXG43VMU5TKOJQHA3TCMBUGUYKC5QC> . You are receiving this because you authored the thread.Message ID: ***@***.***>