Enforce strict npm install script allowlisting

[kkamegawa]

Summary

• Enable strict npm install script policies via .npmrc.
• Explicitly allow the esbuild@0.28.1 install script in package.json.
• Add a dependency security baseline test to verify all lockfile install scripts are allowlisted.

Testing

• Added automated validation for strict npm configuration and dependency install-script allowlisting.

[Copilot]

Pull request overview

This PR tightens dependency supply-chain controls by enabling npm’s strict install-script enforcement and introducing a test baseline that ensures any dependency with an install script in the lockfile is explicitly allowlisted in package.json.

Changes:

• Enable strict-allow-scripts=true via .npmrc (removing the empty allow-scripts= setting).
• Add package.json#allowScripts approval for esbuild@0.28.1.
• Add a dependency security baseline test that validates strict npm policy and that all lockfile install-script packages are allowlisted.

Dependency-security guard notes

• Changed packages: none (no dependency version changes in this PR; allowScripts references existing esbuild@0.28.1).
• Added/updated tests: src/test/suite/dependencyVersions.test.ts (new allowlist/strict-policy baseline test).
• Validation command status (not provided in PR description):
  • npm run compile: not provided
  • npm run lint: not provided
  • npm test: not provided
  • npm run security:check: not provided

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/test/suite/dependencyVersions.test.ts	Adds a baseline test to assert strict npm allow-scripts policy is enabled and that lockfile install-script packages are allowlisted.
package.json	Introduces allowScripts allowlist entry for esbuild@0.28.1.
.npmrc	Enables strict install-script enforcement with strict-allow-scripts=true.