fix(investigate): skip npm bump on yarn/pnpm repos instead of failing (breaks re-investigation loop)

[toufali]

Fixes #111.

On repos without package-lock.json (yarn/pnpm, e.g. mozilla/fxa), the npm-bump remediation runs npm audit fix + npm-bump.sh and fails (ENOLOCK / base64: package-lock.json: No such file). Because the remediate job errors, the alert is never tagged investigated/…, so the scheduled sweep re-investigates it every cycle — a runaway loop.

This makes the Run npm audit fix step detect the absence of package-lock.json and skip gracefully (fixed=false, exit 0). The bump-PR step is then skipped, the job succeeds, the alert gets tagged, and the loop stops. Full yarn support (resolutions) can come later; this stops the bleeding.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates the security-alert investigation workflow to avoid failing on repositories that don’t use npm’s package-lock.json, preventing repeated re-investigation loops when remediation can’t be performed.

Changes:

• Add an early check in the Run npm audit fix step to detect missing package-lock.json (yarn/pnpm repos) and skip the npm bump path gracefully.
• Ensure the step sets fixed=false and exits successfully so downstream bump-PR creation is skipped and the workflow can still tag the alert as investigated.