Otherwise we're not really respecting the package-lock file and won't get
repeatable results.
Also:
- Clean up old error handling for npm<3. Were on npm 8 now. Probably
can get rid of this.
- Use the shorthand `npm ci` rather than `npm clean-install` just for
consistency with code elsewhere.
- Update comments in tests to be explicit about use of ci rather than
install
437418d367