I suspect this is why some contributors kept accidentally including a new `codex-cli/package-lock.json` in their PRs. Note the `Dockerfile` still uses `npm` instead of `pnpm`, but that appears to be fine. (Probably nicer to globally install as few things as possible in the image.)