fix: use npm ci with package-lock.json and keep direct push

Co-authored-by: gcatanese <1771700+gcatanese@users.noreply.github.com>