deps: update bin-links, promise-spawn, and pacote - #10152

…10044)

## Summary

When `npx <package>` infers an executable from package `bin` metadata,
the executable name becomes part of a synthetic npm script. On Windows,
that script is ultimately interpreted by `cmd.exe`. This change protects
the inferred executable token according to the selected shell instead of
forwarding it unquoted.

Supporting dependency PR: npm/promise-spawn#166

## Changes

### `lib/run-script.js`

- Escape the executable token when no explicit `call` script was
supplied.
- Select the escaping strategy from `scriptShell`, including POSIX
shells selected on Windows.
- For `cmd.exe`, protect command separators, spaces, command keywords,
and other cmd metacharacters.
- Reject executable names containing double quotes, percent signs,
exclamation marks, or control characters that cannot be safely
represented as a cmd executable token.
- Preserve `call` as an intentionally supplied shell script; its
arguments are not treated as inferred executable names.

### `lib/index.js`

- On a matching npx-cache hit, select the inferred command from the
installed package manifest rather than mutable registry metadata.

This cache-manifest adjustment is related hardening and may be split
into a separate change during review if preferred.

### Tests and documentation

- Add unit coverage for cmd.exe token encoding and rejection cases.
- Add coverage for POSIX escaping when a POSIX shell is selected on
Windows.
- Add normalized-bin registry regressions covering command separators
and cache metadata mismatches.
- Document the shell-specific executable handling and rejected cmd.exe
characters.

## Dependency status

The required promise-spawn fix is released and bundled as
@npmcli/[email protected] through #10152. This branch is rebased onto
latest and no longer carries a duplicate bundled dependency diff.

## Validation

- Focused and full libnpmexec tests, eslint, and template-oss postlint
pass locally on Node 24.15.0.
- Mutation testing confirms the shell and cache regressions fail without
the production changes.
- Added PowerShell-specific construction coverage and a Windows runtime
test for inferred executable invocation.
- The npm/cli CI matrix passes on Linux, macOS, and Windows across all
configured Node versions.
- No vulnerability reproduction or malicious command execution was run.

## Review status

Ready for review.

---------

Co-authored-by: Copilot <[email protected]>
Copilot-Session: 3e53db77-0fe4-4320-8ada-f2962ddd303c
Copilot-Session: 155db33f-8c59-4859-a9b9-374c3a77e721

)

## Summary

Route linked-install bin cleanup paths through `bin-links#getPaths()`
instead of manually joining lockfile-provided bin keys. Regular
`Node.binPaths` already uses this API, so both strategies can share the
defensive bin normalization introduced by npm/bin-links#187.

This is the Arborist integration for CLI-CROW-GEN-002. It does not
introduce an Arborist-owned normalizer or modify the bundled dependency.

## Changes

- Replace linked-mode manual bin path derivation with
`bin-links#getPaths()` using the dependency's consumer-facing
installation path, not its store path.
- Add `Node.binPaths` regression coverage for traversal-bearing,
absolute, Windows-style and invalid bin metadata, including preservation
of the caller's metadata.
- Add hoisted and linked optional-extraction-failure regressions that
verify an external sentinel survives cleanup with scripts disabled.

## Dependency status

npm CLI now bundles released [email protected] through #10152. This branch
is rebased onto latest and uses that released normalization. A
corresponding release/v11 backport is still needed.

## Validation

- Focused and full @npmcli/arborist tests, eslint, and template-oss
postlint pass locally on Node 24.15.0.
- Mutation testing confirms the direct isolated-tree regression fails
when the production getPaths() integration is removed.
- The npm/cli CI matrix passes on Linux, macOS, and Windows across all
configured Node versions.
- No dependency installs, lockfile changes, snapshots, generated files,
or CI changes.

---------

Co-authored-by: Copilot <[email protected]>
Copilot-Session: 3e53db77-0fe4-4320-8ada-f2962ddd303c
Copilot-Session: eac8b072-e785-47d5-ba34-9a7b20684ae0