docs(ci): add note that configuration must be consistent between install and ci

[nlf]

related to #4664

[npm-robot]

found 1 benchmarks with statistically significant performance improvements

• app-large: clean

timing results

app-large	clean	lock-only	cache-only	cache-only peer-deps	modules-only	no-lock	no-cache	no-modules	no-clean	no-clean audit
npm@8	74.912 ±7.93	37.654 ±0.44	23.023 ±0.39	26.155 ±0.92	3.741 ±0.02	3.866 ±0.15	3.050 ±0.09	15.251 ±0.09	2.988 ±0.01	4.244 ±0.04
#4666	65.680 ±0.15	38.522 ±0.38	23.588 ±0.07	26.454 ±0.79	3.865 ±0.09	3.950 ±0.15	3.029 ±0.01	16.095 ±0.21	3.083 ±0.08	4.381 ±0.18

app-medium	clean	lock-only	cache-only	cache-only peer-deps	modules-only	no-lock	no-cache	no-modules	no-clean	no-clean audit
npm@8	44.972 ±0.05	28.994 ±0.40	16.835 ±0.03	17.939 ±0.01	3.551 ±0.01	3.481 ±0.04	3.061 ±0.03	11.204 ±0.03	2.848 ±0.00	3.889 ±0.07
#4666	48.116 ±2.09	29.265 ±0.39	17.237 ±0.11	18.546 ±0.84	3.504 ±0.04	3.464 ±0.00	3.103 ±0.09	11.372 ±0.05	2.887 ±0.02	3.960 ±0.16

[rtorr]

Could the lock file keep a list of commands used it was generated with? npm ci could then check for that. Just curious. Does seem like it could be a mess to maintain.

[lukekarrys]

@rtorr I think that's a good idea and would be an interesting RRFC. Would be even easier to implement once npm/rfcs#566 lands.