fix: detect package manager and lockfile in automerge workflow

[k80bowman]

Removes the npm and package-lock.json defaults so yarn and pnpm callers no longer need to specify inputs.

Adds a detect step which uses the inputs when set, otherwise finds the lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml) and infers the package manager from its name.

[iowillhoit]

I think this looks good.

• All four input combinations (both set / either set / neither) resolve correctly.
• The step runs after checkout so the [ -f ] sees checked out files.
• npm is still the default (loop checks for package-lock.json first)
• This fixes non-npm callers that previously got the hardcoded package-lock.json