scripts/markdownlint deletes the tracked package-lock.json and modifies package.json #24446

Error Report

Please answer the following questions before submitting your issue. Thanks!

1. What is the URL/path of the document related to this issue?

   scripts/markdownlint

2. How would you like to improve it?

   When markdownlint is not installed globally and ./node_modules/.bin/markdownlint does not exist yet, running ./scripts/markdownlint <files> deletes the tracked package-lock.json file and modifies package.json:

   $ ./scripts/markdownlint some-file.md
   $ git status --short
    D package-lock.json
    M package.json

   The cause is in the following part of the script:

   had_lock=
   if test -f package-json.lock ; then
     had_lock=true
   fi
   npm install --save-dev 'markdownlint-cli@0.17.0'
   if [[ -z "$had_lock"  ]] ; then
     rm -f package-lock.json
   fi

   • The lock file check uses package-json.lock instead of package-lock.json, so had_lock is always empty and package-lock.json is always removed. package-lock.json has been tracked in the repository since Add cloud scripts (#8769) #8881, so this removes a tracked file.
   • npm install --save-dev adds "markdownlint-cli": "^0.17.0" to devDependencies in package.json, and the script does not revert it.

   Because AGENTS.md and several skills in .agents/ instruct agents to run ./scripts/markdownlint <files> for validation, these unrelated changes can easily end up in doc PRs.

   Suggested fix: install markdownlint-cli without modifying the tracked files, for example, with npm install --no-save 'markdownlint-cli@0.17.0', and remove the had_lock logic. Alternatively, add markdownlint-cli to devDependencies in package.json and package-lock.json.