Migration pins lockfile-only package managers and can break CI

[TheAlexLichter]

Describe the bug

A project with only a lockfile has no exact package-manager set.
But vp migrate adds an exact devEngines.packageManager declaration.

This can break existing CI before Vite+ runs.

For example, actions/setup-node followed by npm ci may use the npm version bundled with Node, which can differ from the version pinned by the migration.

Ideas for a solution:

• Keep existing packageManager or devEngines.packageManager declarations.
• Leave projects without either declaration unpinned (but warn!)
• Use the package manager resolved from the lockfile only for migration capability checks.
• Keep explicit version pinning as a separate action (vp env pin)

Reproduction

Steps to reproduce

No response

System Info

-

Used Package Manager

npm

Logs

-

Validations

• Read the Contributing Guidelines.
• Check that there isn't already an issue for the same bug.
• Confirm this is a Vite+ issue and not an upstream issue (Vite, Vitest, tsdown, Rolldown, or Oxc).
• The provided reproduction is a minimal reproducible example.