fix(arborist): derive linked bin cleanup paths through bin-links - #10266

)

## Summary

Route linked-install bin cleanup paths through `bin-links#getPaths()`
instead of manually joining lockfile-provided bin keys. Regular
`Node.binPaths` already uses this API, so both strategies can share the
defensive bin normalization introduced by npm/bin-links#187.

This is the Arborist integration for CLI-CROW-GEN-002. It does not
introduce an Arborist-owned normalizer or modify the bundled dependency.

## Changes

- Replace linked-mode manual bin path derivation with
`bin-links#getPaths()` using the dependency's consumer-facing
installation path, not its store path.
- Add `Node.binPaths` regression coverage for traversal-bearing,
absolute, Windows-style and invalid bin metadata, including preservation
of the caller's metadata.
- Add hoisted and linked optional-extraction-failure regressions that
verify an external sentinel survives cleanup with scripts disabled.

## Dependency status

npm CLI now bundles released [email protected] through #10152. This branch
is rebased onto latest and uses that released normalization. A
corresponding release/v11 backport is still needed.

## Validation

- Focused and full @npmcli/arborist tests, eslint, and template-oss
postlint pass locally on Node 24.15.0.
- Mutation testing confirms the direct isolated-tree regression fails
when the production getPaths() integration is removed.
- The npm/cli CI matrix passes on Linux, macOS, and Windows across all
configured Node versions.
- No dependency installs, lockfile changes, snapshots, generated files,
or CI changes.

---------

Co-authored-by: Copilot <[email protected]>
Copilot-Session: 3e53db77-0fe4-4320-8ada-f2962ddd303c
Copilot-Session: eac8b072-e785-47d5-ba34-9a7b20684ae0
(cherry picked from commit be1b7bc)