feat: Add skip-install input

[Mrtenz]

Explanation

The action currently always runs yarn install (and surrounding cache lookups) as part of its setup. There are workflows that only need the repository checked out and Node.js available — for example, publishing to npm, where Node.js is required to run the publish action but installing the package's dependencies is undesirable from a supply-chain-security perspective. For those workflows, the install step is both wasted time and unnecessary attack surface.

This adds a new skip-install input (default false). When set to true, the action still performs the checkout and Node.js setup (including corepack enable and yarn hydration, so yarn itself is available), but skips:

• The yarn.lock download and try-skip-setup cache lookup
• The node_modules cache restore
• The setup-node yarn cache restore
• yarn --immutable
• yarn allow-scripts
• The post-install cache save

A new test-skip-install job in build-lint-test.yml exercises the new path and asserts that Node.js is set up, node_modules is absent, and no caches were consulted.

---

Note

Low Risk
Opt-in CI behavior change with default unchanged; reduces install surface when enabled rather than altering existing install paths.

Overview
Adds a skip-install action input (default false) so workflows can get checkout + Node.js (and Corepack/Yarn hydration) without installing dependencies or touching install caches.

When skip-install: true, the composite action skips yarn.lock prefetch, node_modules cache lookup/restore/save, setup-node yarn cache, yarn --immutable, and yarn allow-scripts. README documents the option; test-skip-install in CI asserts Node is configured, node_modules is absent, and cache outputs are not hit.

^{Reviewed by Cursor Bugbot for commit 640ad34. Bugbot is set up for automated code reviews on this repo. Configure here.}