Is there a way of making “npm ci” install devDependencies, or “npm install” not update package-lock.json?

npm ci does install both dependecies and dev dependencies. But if you use npm ci --production or if your NODE_ENV is set to production, then it avoids installing dev dependencies.
Please check docs here.

With the --production flag (or when the NODE_ENV environment
variable is set to production), npm will not install modules listed in
devDependencies.

NOTE: The --production flag has no particular meaning when adding a
dependency to a project.