fix(config): avoid exporting persistent allow-scripts - #9913

Please extend this test so we can test that an already-present explicit npm_config_allow_scripts value must remain unchanged. We only want to stop npm from synthesizing the variable from persistent config; explicitly injected environment policy must remain visible so resolveAllowScripts()  can reject it during project installs.

Something like this:

  envConf['allow-scripts'] = 'sharp'
  env.npm_config_allow_scripts = 'sharp'
  setEnvs(config)
  t.equal(
    env.npm_config_allow_scripts,
    'sharp',
    'an explicit environment policy remains inherited'
  )
  t.end()

Added in 3a3a553: the setEnvs coverage now preloads an explicit npm_config_allow_scripts=sharp value and verifies that it remains unchanged. Verified with Node 24.15.0; the full @npmcli/config test suite passes with 100% coverage, and ESLint passes for the changed files.

Also, help us adding this test in resolve-allow-scripts.js so we have good test coverage for this fix

t.test('allow-scripts environment policy is rejected in project-scoped installs', async t => {
  const mock = await mockNpm(t, {
    prefixDir: {
      'package.json': JSON.stringify({ name: 'p' }),
    },
    globals: {
      'process.env.npm_config_allow_scripts': 'canvas',
    },
  })
  const resolveAllowScripts = loadResolver(t)
  await t.rejects(
    resolveAllowScripts(mock.npm),
    { code: 'EALLOWSCRIPTS', message: /--allow-scripts is not allowed/ }
  )
})

Added in 3a3a553: resolve-allow-scripts now covers a project-scoped install with npm_config_allow_scripts=canvas and asserts EALLOWSCRIPTS. The targeted resolver test and ESLint pass with Node 24.15.0.

Thanks for the fix. Marking allow-scripts  as envExport: false is the right shared solution: it prevents Config.load() / setEnvs() from turning file-backed policy into an environment-layer override before either npm run or Pacote Git preparation starts a child process. This addresses #9912 and actually fixes the persistent- .npmrc case in #9783 .