ci-secure: packageManager pin is read from the root package.json only

The dependency-install-scripts check (P14.25) decides whether npm lifecycle scripts run by default by reading the packageManager field in the repository's root package.json. In a monorepo or a workspace where the job installs from a nested package (its own package.json with a different packageManager pin, or none), the finding can name the wrong npm major in its condition sentence — reassuring the reader about a version the job does not actually resolve.

Scope: precision of the per-manager condition note, not a false positive/negative in whether the finding fires. Fix would resolve the packageManager pin relative to the install's working directory (working-directory: / cd), falling back to root.

Found during the ci-secure launch-readiness review (panel P2).