Fail closed when an unsupported lockfile changes

[oalders]

Closes #133

Changes

• bin/diff-lockfiles.js: changed files whose basename is pnpm-lock.yaml, yarn.lock, bun.lock, bun.lockb, or npm-shrinkwrap.json (any directory) are reported on stderr as Unsupported lockfile changed, not diffed: <path>.
  • With --fail-on-downgrade, any such change exits 1, taking precedence over 2.
  • Without the flag the exit code is unchanged (0), and stdout is identical either way.
• git diff --name-only now uses -z (NUL-delimited). Without it, git C-quotes non-ASCII paths (e.g. "caf\303\251/yarn.lock"), so both the new check and the existing package-lock.json filter silently missed them (fail-open).
• README.md and CLAUDE.md document the new exit-code behaviour.

Testing

• New CLI tests: an unsupported lockfile in a subdirectory, with and without the flag; a non-ASCII directory; a downgrade plus an unsupported lockfile together (exit 1, identical stdout with and without the flag).
• All 4 new tests fail against the base bin/diff-lockfiles.js and pass with the fix.
• npm test: 37/37 pass. npm run lint: clean.

Declined findings

• Table-driven test over all five names: it would only re-assert the constant set.
• Anchoring /package-lock\.json$/: pre-existing; commit 84d480e chose "ends with" on purpose.
• --no-renames, case-insensitive or glob matching, adding deno.lock: no real producer of those cases; the list matches the issue scope.
• Escaping filenames in the stderr warning: the exit code that drives the gate is unaffected, and a PR author who controls paths can already print arbitrary CI log lines.
• Mentioning exit 1 in the --help text: the README exit-code table documents it, and reviewers disagreed with each other on this.
• Further CLAUDE.md rewording (re-splitting the exit-code clause, dropping the -z note): already addressed in round 1; the -z note guards against removing it.
• Windows path separators in tests: CI runs only on ubuntu-latest.

🤖 Generated with Claude Code · Opus 5.5