Skip writing lockfile hash in postinstall when installed as a dependency (#725)

[bedrich-schindler]

No description provided.

[bedrich-schindler]

Why this fix: alternatives considered

1. INIT_CWD/path heuristic (à la skip-local-postinstall)
Compares where npm install was invoked with where the script runs. Works for
the common case, but it is package-manager-specific, unset when the script is
run directly, and has symlink/workspace edge cases (it would skip the hash in
a legitimate checkout inside a monorepo). The referenced package actually
solves the inverse problem (skip locally, run for consumers) and would add a
dependency.

2. Append || true to the postinstall (the 0.63.0 style)
Hides the failure for consumers, but also silently swallows real errors in the
repo checkout.

3. Exit early when package-lock.json is absent ✅ (chosen)
npm unconditionally excludes the lockfile from published tarballs, so its
absence is a deterministic marker of "installed as a dependency" — not a
heuristic. It is package-manager- and invocation-independent, and its
worst-case failure mode is benign: the hash is not written and the
devcontainer just does one unnecessary reinstall.