gitea: stop a real npm retention when a file was not read whole

A lockfile that could not be read is one of its repository's files that
could not be read (hq ADR 0251 §4): a version only it pins would be deleted
while in use. A real run now refuses on files_not_read as it does on
repositories_unread; a dry run still reports.

modules/gitea/README.md

@@ -35,8 +35,9 @@ why under `keeps_all`.
 **Nothing is deleted on partial knowledge.** A repository whose files could not be listed, or a
 manifest or lockfile that could not be fetched, is named under `repositories_unread` in every answer,
 and a real run then deletes nothing at all. A file that was fetched but is not readable (broken JSON) is
-named under `files_not_read`; what it would have named is not known, and the operator reads that list
-before a real run. Under `node_modules` nothing is read: that is what a lockfile already says. An empty
+named under `files_not_read`, and so is a lockfile entry of a shape the reader does not know (the rest of
+that file is still read); what it would have named is not known, so a real run then deletes nothing at all
+either. Under `node_modules` nothing is read: that is what a lockfile already says. An empty
 repository, or one without its default branch, holds nothing to read and is not a failure.
 
 A real run deletes each version through the forge's own interface (`DELETE