ci: mailparser without a committed lockfile again - the licence gate is not the place to decide CI tools in passing

A lockfile in the repository put the whole mailparser tree into the
dependency graph, and the licence gate blocked two packages of it:
@zone-eu/mailsplit (MIT OR EUPL-1.1+) and leac (reported as JSON AND MIT,
its own LICENSE file is MIT). Whether tools installed only in CI answer to
the gate that guards what ships is a decision for the owner, so the
install is back to the pinned top level the gate passed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: donislawdev

.github/mailparser/package-lock.json

@@ -1376,16 +1376,17 @@ jobs:
           # Mail is read by mailparser beside Python's email package - the
           # parser much of the mail handling written in Node uses, and the one
           # that refuses a message of more than 1000 MIME entities
-          # (docs/EML-2026-10-07.md section 5.1). Installed with npm ci from the
-          # lockfile in .github/mailparser, so the whole tree is the one
-          # committed rather than whatever the registry resolves that day
-          # (review of #173), outside the checkout, and named to the guard
-          # through TFG_MAILPARSER. Asked for its version, so a package that did
-          # not install stops this step, and the guard fails if it is named and
-          # reads nothing.
-          mkdir -p "$RUNNER_TEMP/mailparser"
-          cp .github/mailparser/package.json .github/mailparser/package-lock.json "$RUNNER_TEMP/mailparser/"
-          npm ci --prefix "$RUNNER_TEMP/mailparser"
+          # (docs/EML-2026-10-07.md section 5.1). Pinned, installed outside the
+          # checkout, and named to the guard through TFG_MAILPARSER. Asked for
+          # its version, so a package that did not install stops this step, and
+          # the guard fails if it is named and reads nothing.
+          #
+          # Without a committed lockfile, on purpose for now: one in the
+          # repository puts the whole tree into the dependency graph, and the
+          # licence gate then blocks two packages of it (review of #173,
+          # docs/REVIEW-173-2026-10-07.md). Whether CI-only tools belong under
+          # that gate is the owner's decision, not a fix.
+          npm install --prefix "$RUNNER_TEMP/mailparser" mailparser@3.9.36
           echo "TFG_MAILPARSER=$RUNNER_TEMP/mailparser/node_modules/mailparser" >> "$GITHUB_ENV"
           node -e "console.log('mailparser', require(process.argv[1] + '/package.json').version)" "$RUNNER_TEMP/mailparser/node_modules/mailparser"