fix(ci): the PM cache prune reads its lock-source input under the runner's real name

The runner maps a hyphenated input to INPUT_LOCK-SOURCE, not INPUT_LOCK_SOURCE.
The registration step read the underscored name, saw nothing, and threw
"invalid lockSource" from every job that composed setup-pm, so the whole CI
run failed before any consumer ran. The unit test used the same wrong
spelling, which is why it stayed green; it now drives the real mapping.

.github/actions/setup-pm/prune/index.mjs

@@ -6,7 +6,8 @@ import { pathToFileURL } from 'node:url'
 // this action's post runs first, pruning the cache just before it is saved.
 export function run(env, execute = spawnSync) {
   if (!env.STATE_python) {
-    for (const [key, value] of Object.entries({ python: env.INPUT_PYTHON, cache: env.INPUT_CACHE, lockSource: env.INPUT_LOCK_SOURCE })) {
+    // The runner keeps hyphens when it maps an input to INPUT_<NAME>.
+    for (const [key, value] of Object.entries({ python: env.INPUT_PYTHON, cache: env.INPUT_CACHE, lockSource: env['INPUT_LOCK-SOURCE'] })) {
       if (!value || /[\r\n\0]/.test(value)) throw new Error(`invalid ${key}`)
       appendFileSync(env.GITHUB_STATE, `${key}=${value}\n`, 'utf8')
     }

tests-js/setup-pm-post.test.mjs

@@ -18,7 +18,7 @@ it('prunes the saved uv cache to the lock at teardown, never during registration
   const cache = join(directory, 'cache with spaces')
   const python = join(directory, 'prepared Python')
   const lockSource = join(directory, 'checkout')
-  run({ GITHUB_STATE: state, INPUT_PYTHON: python, INPUT_CACHE: cache, INPUT_LOCK_SOURCE: lockSource }, execute)
+  run({ GITHUB_STATE: state, INPUT_PYTHON: python, INPUT_CACHE: cache, 'INPUT_LOCK-SOURCE': lockSource }, execute)
   expect(execute).not.toHaveBeenCalled()
   const saved = Object.fromEntries(readFileSync(state, 'utf8').trim().split('\n').map(line => {
     const index = line.indexOf('=')