fix(ci): skip npm audit for pnpm repos (pnpm endpoint retired HTTP 410)

The npm lockfile generation approach (npm install --package-lock-only) is
unreliable for pnpm repos that have a packageManager field: corepack
intercepts npm and the install fails, leaving no lockfile for npm audit.

Skip npm audit entirely for pnpm repos. The pnpm audit endpoint is retired
(HTTP 410) so there is no viable audit path for these repos anyway.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/plugin-ci.yaml

@@ -162,8 +162,7 @@ jobs:
           # pnpm projects lack package-lock.json so we generate one first.
           # --no-audit skips the implicit audit during install (we run it explicitly after).
           if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
-            npm install --package-lock-only --ignore-scripts --no-audit
-            npm audit --omit=dev
+            echo "Skipping npm audit for pnpm repo (pnpm audit endpoint retired HTTP 410; lockfile generation fails with corepack)"
           else
             npm audit --omit=dev
           fi