[Bug]: Provider update ignores npm's min-release-age and fails silently #21422

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server

Steps to reproduce

1. Set min-release-age=3 in ~/.npmrc
2. Install a provider CLI globally (npm, Vite+, bun, pnpm, …) and wait for a release younger than that policy
3. T3 advertises an update using the registry's latest tag and offers …@latest
4. Press Update

Expected behavior

T3 either installs the version it advertises, or does not advertise a version the package manager will refuse yet.

Actual behavior

latestVersion comes from registry.npmjs.org/<pkg>/latest (fetchNpmLatestVersion in packages/provider-core/src/server/maintenanceResolver.ts) with no release-age check, while the install command resolves @latest under the user's min-release-age. The update reports success, the version does not change, the prompt returns, and nothing tells the user the policy blocked the release.

Reproduced with opencode-ai 1.19.1 → 1.19.3 (published 2 days earlier):

$ vp i -g opencode-ai
info: Installing 1 global package with Node.js 24.22.0
+ Installed opencode-ai 1.19.1        # npm latest is 1.19.3

Same root cause as #14249 for pnpm's minimumReleaseAge; #19855 is the ACP-registry counterpart. makeTargetedProviderUpdateAction already pins exact versions for the npm-global: and vite-plus-global lockKeys, so pinning the advertised version, or resolving latestVersion under the same policy, fixes it.

Impact

Minor bug or occasional failure

Version or commit

0.1.1-nightly.20261018.3335

Environment

macOS (Darwin 27.2), T3 Code Nightly desktop, Node 24.22.0, npm 11.19.1 via Vite+ 1.1.0

Workaround

Remove min-release-age from ~/.npmrc