fix(pnpm-policy): generate before the first install

[pyramation]

Summary

A freshly scaffolded workspace could not run pnpm-policy generate: intersect defaults to true, so load() always read pnpm-lock.yaml and died with "No pnpm-lock.yaml … Run pnpm install first" — before a lockfile exists. But intersection only narrows individual inventory names; a config with scopes: and no inventory: has none to narrow, so the read was gratuitous.

-    resolved: intersect ? readWorkspacePackages(workspaceDir) : undefined,
+    const needsLockfile = intersect && inventory != null;
+    resolved: needsLockfile ? readWorkspacePackages(workspaceDir) : undefined,

This is what lets pgpm init workspace ship a policy that generates and checks on a clean checkout (constructive-io/pgpm-boilerplates#5).

Also fixes a wrong generated comment in the same case — with no inventory the file claimed "First-party membership comes from the inventory" when it in fact comes from the scopes: the config claims.

Link to Devin session: https://app.devin.ai/sessions/ffa3b012deac4eb7afb8f49a9af9f9ca
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring