`npm ci` doesn't try to reconcile package.json with package-lock.json,
nor with any existing packages in `node_modules`. `npm ci` simply
deletes `node_modules` and uses the packages from `package-lock.json`.
As a result, `npm ci` is much, much faster than `npm install`.
We should use it wherever possible.