fail if the package-lock.json needs regenerated

[chee]

similar to our npm run regenerate failing test, we want to fail if a new package-lock.json will be required.

something to think about: would this mean every release-please PR would fail until somebody checked into it and ran npm install ?