chore: remove deprecated npm-shrinkwrap.json

[sjinks]

From the npm changelog:

npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.

This PR removes npm-shrinkwrap.json and instructs npm to bundle production dependencies into the dist archive.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

package.json

Package	Version	License	Issue Type
rxjs	^7.8.2	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
npm/graphql-ws	6.2.0	🟢 5.3	Details Check Score Reason Code-Review 🟢 4 Found 12/27 approved changesets -- score normalized to 4 Maintained 🟢 10 16 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found SAST 🟢 8 SAST tool detected but not run on all commits
npm/rxjs	^7.8.2	Unknown	Unknown

Scanned Files

• .github/workflows/sync-shrinkwrap.yml
• package-lock.json
• package.json

[Copilot]

Pull request overview

This PR modernizes the project’s dependency-locking/publish approach by removing the deprecated shrinkwrap sync tooling and switching to dependency bundling for distributed artifacts, aligning with npm v12+ behavior changes.

Changes:

• Removed shrinkwrap sync scripts and added bundleDependencies configuration in package.json.
• Updated package-lock.json to mark bundled dependencies (bundleDependencies list + inBundle flags).
• Deleted the shrinkwrap sync helper and the associated GitHub Action workflow; removed the CI shrinkwrap check step.

Reviewed changes

Copilot reviewed 5 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
package.json	Removes shrinkwrap-related scripts and enables dependency bundling for packaging/publishing.
package-lock.json	Records bundled dependency metadata (bundleDependencies and widespread inBundle annotations).
helpers/sync-shrinkwrap.js	Deletes the shrinkwrap synchronization helper (no longer needed with npm v12+).
.github/workflows/sync-shrinkwrap.yml	Removes the workflow that auto-synced npm-shrinkwrap.json on PRs.
.github/workflows/ci.yml	Drops the shrinkwrap verification step from the CI matrix.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud