Update release instructions to propagate new version to `package-lock.json`

[chrahunt]

The current release process doesn't propagate the new package version to package-lock.json, so subsequent updates to package-lock.json pick up the new version number. See #260 for an example.