[shavonn]

Description

The npm publish phase of finalize-release.sh ran npm install before executing
the configured build command. This switches it to npm ci, which performs a
clean, reproducible install directly from the lockfile — the recommended approach
in CI. It's faster and guarantees the exact pinned dependency versions are used
when building before publish.

Because release-champion runs in arbitrary consumer repositories, the change
prefers npm ci only when a lockfile (package-lock.json / npm-shrinkwrap.json)
is present and falls back to npm install otherwise, since npm ci errors out
hard when no lockfile exists.

Fixes # (issue)

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing usage to not work as expected)
• Refactor / internal change (no functional impact)
• Documentation update
• CI / tooling change

How Has This Been Tested?

The change is a conditional around the install step in the publish-npm path.
The lockfile branch (npm ci) and the fallback branch (npm install) are both
covered by the existing bats suite for the publish flow.

• bats tests/ passes
• Added or updated tests covering the change
• Manually exercised the change end-to-end in a fork (Phase 1 / Phase 2 / npm publish, as applicable)

Test Configuration:

• Runner OS: ubuntu-latest
• Node version (if npm publishing is involved): 24
• Inputs exercised: publish-npm: true with a build command, repos both with and without a lockfile

Checklist

• My code follows the style guidelines of this project (bash set -euo pipefail, quoted expansions)
• I have performed a self-review of my code
• I have added tests that prove my fix is effective or that my feature works
• New and existing tests pass locally with my changes
• I have updated the README and action.yml descriptions where relevant
• My commit messages follow Conventional Commits
• Any breaking changes (input renames, default changes, output changes) are clearly called out above