[rush] Omit registry URLs from the bootstrap lockfile

[Jamie Magee (JamieMagee)]

Summary

The checked-in install-run-rush lockfile records registry URLs from the package feed proxy. This adds omit-lockfile-registry-resolved=true to the Rush npm configuration and removes those URLs from common/config/validation/rush-package-lock.json.

Details

install-run-rush copies common/config/rush/.npmrc into its temporary npm project before installing Rush. I regenerated the validation lockfile from that bootstrap project with npm 11.19.0 and the package feed proxy used by the post-publish pipeline.

A fresh unseeded install selected newer transitive versions, so I rejected that output. To keep the existing dependency graph, I made a temporary copy of the current lockfile without resolved fields and seeded the bootstrap npm install with it. The intermediate file stayed outside the repository. The final lockfile matches the original structure after ignoring resolved fields, so dependency versions, integrity hashes, lockfile version 3, and platform metadata are unchanged. The diff removes 397 resolved entries and adds the npm setting.

How it was tested

• Generated twice through node common/scripts/install-run-rush.js --help with an isolated RUSH_TEMP_FOLDER; both outputs were byte-identical.
• Ran install-run-rush with INSTALL_RUN_RUSH_LOCKFILE_PATH pointing to the regenerated lockfile. Its npm ci bootstrap completed successfully.
• Confirmed npm config get omit-lockfile-registry-resolved returns true in the bootstrap project.
• Confirmed the validation lockfile contains no resolved fields or pkgs.visualstudio.com URLs.
• Ran node common/scripts/install-run-rush.js change --verify.
• Ran node common/scripts/install-run-rush.js install --to repo-toolbox.
• Ran node common/scripts/install-run-rush.js build --to repo-toolbox --verbose.
• The pre-commit rush prettier check passed.