ci(governance): pass --no-lock to deno run for check-ts-allowlist (closes #294) (#298)

Closes #294. Read-only file walker; lockfile irrelevant.

## Summary

Adds `--no-lock` to the `deno run` invocation for
`scripts/check-ts-allowlist.ts` in `governance-reusable.yml`. The script
imports nothing, so the lockfile is irrelevant; `--no-lock` makes the
check robust to the entire empty / corrupted / stale lockfile failure
class estate-wide.

## Why

`hyperpolymath/echidna#92` had this job failing on every push since
3b03087 (an intentionally-empty `deno.lock` for sweep visibility).
Echidna PR #128 worked around it per-repo by writing minimal valid
content; this PR fixes it at the script-invocation layer estate-wide.

## Test plan

- [ ] CI: governance / Language / package anti-pattern policy stays
green on this branch.

Closes #294.

Author: hyperpolymath

.github/workflows/governance-reusable.yml

@@ -186,7 +186,11 @@ jobs:
 
       - name: Check for TypeScript
         # Read-only execution; never writes outside the runner workspace.
-        run: deno run --allow-read .standards-checkout/scripts/check-ts-allowlist.ts
+        # `--no-lock` so an empty / stale / missing `deno.lock` doesn't fail
+        # `deno run` before the file-walker even starts — the script does not
+        # import anything, so the lockfile is irrelevant to its execution.
+        # See standards#294.
+        run: deno run --allow-read --no-lock .standards-checkout/scripts/check-ts-allowlist.ts
 
       # Shared escape hatch for the banned-language-file checks below.
       # Honours three exemption mechanisms (see