Fix npm v7 / package-lock v2 converter

```
npm WARN old lockfile
npm WARN old lockfile The package-lock.json file was created with an old version of npm,
npm WARN old lockfile so supplemental metadata must be fetched from the registry.
npm WARN old lockfile
npm WARN old lockfile This is a one-time fix-up, please be patient...
npm WARN old lockfile
npm WARN audit 400 Bad Request - POST https://registry.npmjs.org/-/npm/v1/security/audits/quick - Bad Request
{
statusCode: 400,
error: 'Bad Request',
message: 'Invalid package tree, run npm install to rebuild your package-lock.json'
}

```

The issue names no files, tests, or entry points. Start by reproducing the shown npm v7 and package-lock v2 output in synp, then trace the conversion path that handles the package lock; done means conversion completes without the reported invalid package tree or audit error.

Written by the indexing model from the issue text.