chore(ci): remove frozen-lockfile and CI=true from workflows

[John-David Dalton (jdalton)]

Remove redundant frozen-lockfile: 'true' inputs (the older install action accepted this but it's no longer needed) and drop the explicit CI: 'true' env var from the weekly-update apply-updates step (it caused pnpm to use frozen-lockfile during dep updates, breaking the workflow).

---

Note

Low Risk
Low risk workflow-only change that relaxes install/update strictness; potential impact is limited to CI determinism and dependency update behavior.

Overview
Removes redundant frozen-lockfile inputs from the SocketDev/socket-registry install action across ci.yml, provenance.yml, and weekly-update.yml.

Adjusts the weekly dependency update job by dropping CI: 'true' from the Claude update step so dependency update runs don’t implicitly force frozen-lockfile behavior.

^{Written by Cursor Bugbot for commit 2385647. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR