Type checking all repos requires npm install in many repos

[zepumph]

As a project we are running into more and more cases where a project has an npm dependency of @types/* and thus requires an npm install in order for type checking to work.

Paper trails:

• Rosetta: Convert Rosetta 2 to TypeScript rosetta#311
• Kite: Kite npm install needed for pre-commit? aqua#228
• Website repos: https://github.com/phetsims/website-meteor/issues/820
• Scenerystack repos: Add sceneryStack to CT aqua#226 (and currently we just opt out of it manually in typeCheck.ts)

I believe we should have a discussion about this, because it seems obvious that the best long term solution is to require an npm install on any repo that you are trying to type check. That seems idiomatic and nice, but we don't want to cause too much burden to all devs for this.

This brings up other, scope-creepy-kinds of questions:

• Do we need to keep using npm
• Should we use package-lock.json files
• Can we get rid of the dependency we have on grunt in every repo, therefore making most simulation repos not need an npm install step.

I'm creating this issue because we want to have a good solution to this. Currently, over in rosetta, the recommendation @samreid and I gave to @jbphet was just to use @ts-expect-errors on any type errors that are caused from dependency type issues. Booooo.

I believe the people that should be involved in this meeting are:
@jonathanolson @samreid @zepumph and any other parties that are interested.

[zepumph]

I'll start by assigning to @jonathanolson for comment.

[jonathanolson]

Do we need to keep using npm

No, but we could switch to similar things, like pnpm or yarn.

Should we use package-lock.json files

Probably for certain things, yes! This is helpful for the scenerystack build, ideally we should be keeping dependencies stable instead of having them ping around.

Can we get rid of the dependency we have on grunt in every repo, therefore making most simulation repos not need an npm install step.

That would be great, but I don't know about how possible it is.

All of that said, I think if we have developers consistently using a script (like main-pull-status) that takes care of these things, then we won't disrupt things as much whenever repos get added to a "npm update" list.

[zepumph]

Looking through current usages of npm updates, there are many spots that assume that for a given sim to run, you need to update in that sim repo, perennial-alias, and chipper. This issue could potentially break that assumption, like for phetsims/aqua#228, but to start I think I'll focus on just updates to main, working through #405.