npm package-lock Discipline

Why commit package-lock.json / pnpm-lock.yaml, and what goes wrong if developers run floating installs?

Answers use simple, clear English.