fix(review): treat npm project's stray pnpm-lock.yaml as npm, not fail-closed - #658

Warning: Code scanning cannot determine the alerts introduced by this pull request, because 1 configuration present on refs/heads/main was not found:

Actions workflow (scorecard-analysis.yml)

• ❓  supply-chain/branch-protection

View all branch alerts.