Revert "removed carton.lock file" because having fixed+tested module versions makes up for a more stable deployment overall

This reverts commit ab6a566d6c2758100c1638f0cd919b0e09d61b70.