Pin setup-node caching off in the dependency advisory watch

The scheduled watch reads each release line's lockfile in the default
branch's cache scope, so it deliberately writes no dependency cache.
It sets no cache input, but the pinned setup-node enables npm caching
on its own once package.json names npm as its packageManager. Nothing
declares that today; adding it later would silently reopen a
default-branch cache write here. Set package-manager-cache: false, as
five release workflows already do, assert it in the workflow test, and
say how the contract's no-dependency-cache promise is kept.

.github/workflows/dependency-advisory-watch.yml

@@ -89,6 +89,9 @@ jobs:
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
+          # setup-node enables npm caching by itself once package.json names
+          # npm as its packageManager; keep this scheduled job cache-free.
+          package-manager-cache: false
 
       - name: Audit complete frontend dependency graph
         id: audit