Replace unmaintained proper-lockfile with a maintained fork

[bybraveHQ]

Summary

proper-lockfile has had no release since January 2021. This replaces it in packages/testcontainers with @bybrave/proper-lockfile2, a drop-in fork I maintain: same API, types bundled, so @types/proper-lockfile is removed as well. The only source change is the import in src/common/file-lock.ts; withFileLock and its retry options are unchanged.

What the fork fixes that matters for withFileLock, which several Jest workers call at once for the reaper and the port forwarder: the stale-lock takeover was done with rmdir + mkdir, so two processes that both saw a stale lock could both end up holding it (moxystudio/node-proper-lockfile#121). The fork claims stale locks atomically via rename and has regression tests for the race. It also fixes a TypeError when a lock is released while a failed mtime update is being retried (moxystudio/node-proper-lockfile#113), and installs the signal-exit handler on the first lock instead of at require time, so requiring testcontainers no longer changes how the host process reacts to Ctrl-C.

The lockfile diff also drops the nested copy of retry under async-retry: the fork uses retry@0.13, which async-retry already needs, so one copy is now hoisted.

Full disclosure: I maintain the fork.

Verification

• npm run format, npm run lint, npm run lint:ci, npm run knip, npm run check-compiles, npm run check-engines:testcontainers and npm run build --workspace packages/testcontainers: all pass.
• npm install --package-lock-only leaves package-lock.json unchanged.
• npx vitest run packages/testcontainers/src/reaper packages/testcontainers/src/port-forwarder: 15 passed.
• A throwaway test calling withFileLock from 8 concurrent callers: never more than one inside the lock, all 8 ran.
• The publish dry run (npm-publish.yml) needs write access, so a maintainer would have to run it; the change touches only a runtime dependency of testcontainers.

Not breaking

Runtime dependency swap with the same API and CommonJS entry point. The fork's engines is node >=18, below this package's >= 22.22; check-engines confirms the engines field still matches the dependency graph. No public API or docs change.

[cristianrgreco]

Thanks for the PR and for disclosing that you maintain the fork. We’re keeping proper-lockfile. We haven’t had any issues with it here, and we keep the runtime dependencies of testcontainers on widely adopted packages. Closing.