Fix/release intent lockfile gh

[Noah-Tervalon-Nvidia]

Description

The release-intent bot bumps the release version in desktop/package.json but never updated desktop/package-lock.json, so after each automated release the lockfile's root version (top-level version and packages[""].version) fell behind. On develop it reads 0.1.1 while package.json reads 0.1.5, and tooling that checks the two against each other rejects the tree.

The bot now writes both lockfile copies in the same single commit as the other version files, and this PR resyncs the lockfile to 0.1.5.

Release intent

Changelog title

n/a

Changelog body

n/a

Bumps

• services: none
• nvpair-cluster-manager: none
• nvpair-engine-manager: none
• nvpair-errors: none
• nvpair-job-scheduler: none
• nvpair-manual-nodes: none
• nvpair-node-info: none
• nvpair-node-scanner: none
• nvpair-node-settings: none
• nvpair-proxy: none
• nvpair-tui: none
• nvpair-ui-broker: none
• nvpair-workload-manager: none

Scope

• scripts/release-intent/lib.py: new render_package_lock() replaces the two root versions in place, like render_package_json(), and refuses to render if the result differs from the parsed edit in any other field.
• scripts/release-intent/apply_pr.py: reads, renders, and commits the lockfile alongside the other three files, in both apply and --dry-run. read_file_at() now fails loudly when the contents API omits a body, which it does above 1 MB; the lockfile is about 508 KB today.
• desktop/package-lock.json: two-line resync to 0.1.5.
• Docs: the release-intent README lists the fourth file; services/VERSIONING.md points manual minor/major bumps at npm version <version> --no-git-tag-version.
• No bumps: no service binary changes, so the bot applies nothing after merge and develop stays consistent at 0.1.5.

Validation

• python3 scripts/release-intent/test_lib.py: 33 tests pass, including new ones for both root versions, a drifted lockfile, unexpected layouts, and the repository's real lockfile (exactly two lines change).
• apply_pr.py --dry-run with a sample patch release on a scratch copy: package.json and both lockfile versions moved 0.1.5 → 0.1.6 and the lockfile still parsed.
• validate_pr.py --skip-owned-files-check against this description passes.

Risk

Only the release automation and lockfile metadata change. If npm ever writes a lockfile layout the in-place edit does not recognise, apply fails instead of committing, and the versions stop bumping until the script is updated.

Checklist

• I have read the Contributing Guidelines.
• Every commit is signed off (git commit -s), certifying the Developer Certificate of Origin.
• New or existing tests cover the change.
• Relevant documentation is updated.
• I checked the diff, changed filenames, and commit messages for credentials, private data, internal URLs, internal issue identifiers, and generated artifacts.
• I recorded the validation commands and results above.
• I declared version bumps in the release-intent block above. services/versions.json is written by automation — do not edit it by hand.