node-ci: distinguish no-lock-no-deps from no-lock-with-deps (fail fast on deps without a lockfile)

[ArchonVII]

Background

PR #49 fixed the node-ci no-lockfile branch from npm ci (a guaranteed failure) to
npm install --no-package-lock. That is correct for ArchonVII's depless convention. But it
collapses two distinct no-lockfile cases into one behavior:

• no lockfile + no dependencies (depless): install nothing — correct.
• no lockfile + real dependencies: previously failed fast under npm ci; now installs
  nondeterministically without writing a lock.

For controlled ArchonVII repos where the depless convention is enforced this is fine. But as
a reusable workflow consumed by arbitrary repos, silently installing a dependency-bearing
project without a lockfile trades a clear "fail fast" for a quiet, non-reproducible install.

Proposed hardening (3-way)

lockfile exists      -> npm ci
no lock + no deps     -> npm install --no-package-lock   (or skip install entirely)
no lock + has deps    -> fail: "commit a lockfile or opt out via install-command"

"has deps" can be detected by checking package.json for non-empty dependencies /
dev/optional/peerDependencies (e.g. via node -e or jq). The explicit install-command
input remains the escape hatch.

Acceptance Criteria

• node-ci distinguishes no-lock-no-deps (install/skip) from no-lock-with-deps (fail with
  an actionable message).
• install-command still overrides.
• Add/extend a workflow-structure (or new) test asserting the 3-way behavior.
• Release as v1.0.x and move v1 (leased) per the established retag process.

Context

Follow-up to #48 / #49 (depless lockfile hygiene rollout: repo-template#52, archon-setup#124,
hudson-bend#35). Not urgent — current behavior is safe for the known ArchonVII consumer set.