syncpack GHA fails if `npm -g` permission denied

My org is running GHA action runners without root access, which means that `npm install -g` returns permission denied, and this is causing the syncpack GHA to fail (because it always installs syncpack with `-g`). Would you be interested in a PR that adds a config option for whether `npm install` is run with `-g` or not?

(Yeah, there are other ways to solve this problem long-term, like using `bun`, but I am trying to keep this simple.)

Start at the GitHub Action entry point and locate the command that installs syncpack with npm. Add a configuration option that controls whether the install uses the global flag, then verify that the action can run on a runner without root access.

Written by the indexing model from the issue text.