chore(claude-apps-gateway): track cdk/package-lock.json

[bluedoors]

What

Commits claude-apps-gateway/cdk/package-lock.json, which had never been tracked.

Why

This looks like an omission rather than a deliberate exclusion: no .gitignore in the repo excludes lock files, and the sibling CDK app in the same gateway family — claude-apps-gateway-bootstrap/cdk — already tracks its own.

Two concrete benefits:

• Dependabot can remediate transitive CVEs. .github/dependabot.yml scans /** for npm with security updates enabled. Without a lock file it can only bump the direct ranges in package.json, leaving anything inside aws-cdk-lib's dependency tree (321 resolved packages here) unfixable. chore(deps): bump the npm-security group across 3 directories with 2 updates #260 shows the mechanism — it fixed CVEs by editing package.json + lock-file pairs.
• The documented verification gate becomes reproducible. claude-apps-gateway/CLAUDE.md treats npm install && npx cdk synth plus npm test as the strongest automated check, but aws-cdk-lib: ^2.260.0 resolves differently over time — synth output and the 17 assertions could drift with no code change.

Notes

• Committed as generated: lockfileVersion: 3, in sync with package.json (root dependencies / devDependencies match exactly).
• The docs use npm install, never npm ci, so anyone who wants the latest resolution can still delete the lock and reinstall.
• No source, infrastructure, or documentation changes — this is a single added file.

Verification

Run from claude-apps-gateway/cdk, resolving deps from the committed lock:

npm install
npm test                          # 17 passed
npx cdk synth -c imageReady=false # pass-1 synth OK
npx cdk synth -c publicUrl=... -c zoneName=... -c zoneId=... \
  -c ingressCidr=... -c certArn=...   # pass-2 synth OK