test(supply-chain): pin the .npmrc install-script control to the files it guards

[hivecommons-hive]

Test Improvement

Adds tests/npm-lifecycle-scripts.test.mjs. No production, workflow or configuration file changes — one new test file.

#1317 landed a root .npmrc whose one effective line, ignore-scripts=true, is the whole of this repository's defence against dependency lifecycle scripts. Without it npm ci runs preinstall/install/postinstall/prepare from every one of ~1490 resolved packages as arbitrary code on the runner, before any validator, test or lint step, and four of the eleven install call sites sit in jobs holding a write-scoped GITHUB_TOKEN.

Nothing read the control back — grep -rn "npmrc\|ignore-scripts" tests/ scripts/ returned nothing at 92cede9. This pins the contract over the real .npmrc, package.json and .github/workflows/** tree:

Assertion	What it stops
.npmrc is at the repo root and is the only npm config outside node_modules/	deleting it; shadowing it with a second .npmrc in a subdirectory
its effective ignore-scripts is true (last-wins parse, #/; comments ignored)	flipping the value, or commenting the line out
it still carries the reasoning beside the key	the bare flag reading as a cargo-culted default and getting deleted
package.json declares no preinstall/install/postinstall/pre*prepare* hook	a hook added here is silently skipped by ignore-scripts — the failure looks like success
every workflow npm ci/npm install step runs from the repository root	a working-directory that moves the install out from under the root .npmrc
no such step re-enables the hooks	--ignore-scripts=false, --foreground-scripts, NPM_CONFIG_IGNORE_SCRIPTS overrides

Why these assertions are worth their runtime

Each of the six was shown to fail with the control it guards removed, so a green run here is evidence the contract was checked rather than evidence there was nothing to look at. Mutating .npmrc to ignore-scripts=false, adding a postinstall to package.json, and giving a ci.yml install step working-directory: docs plus --foreground-scripts turns four of the six red; deleting the comments turns the third red; adding a second .npmrc under scripts/ turns the first red.

This is deliberately not filed as a coverage gap: ignore-scripts=true is a config key with no executable region, so no coverage profile can ever show it dark. It needs a contract test over the real files, which is what this is.

Verification

Branched from origin/main at 92cede9, node v26.10.0:

• TZ=UTC node --test over tests/ — 2379 pass / 0 fail with this file, 2373 pass / 0 fail without it. The six new tests are the whole of the difference.
• npx prettier --check tests/npm-lifecycle-scripts.test.mjs — clean.

Scope

Disjoint from the other open hold-gated PRs: #1319 (helpers-script-sandbox, coverage-gate-thresholds, package.json), #1321 and #1323 (both CONTRIBUTING.md parity). This adds one new file and touches nothing they touch — in particular it does not edit package.json, since node --test discovers tests/ without registration.

Related Issue

Closes #1324

---

Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.