fix(arborist): expose store node_modules via NODE_PATH for linked-strategy install scripts

[manzoorwanijk]

In continuation of our exploration of using install-strategy=linked in the Gutenberg monorepo, which powers the WordPress Block Editor.

Under install-strategy=linked, a package whose install script invokes a separate helper bin to locate a native binding fails (e.g. unrs-resolver via napi-postinstall, and the wider napi-postinstall family). The helper bin is reached via a .bin symlink, so Node resolves it to its own realpath in its own store dir, from which it can't require.resolve the host's binding — so it declares it missing and re-downloads (fatal on a restricted registry/proxy). Hoisted works because the binding is hoisted onto the helper's resolution path.

How

When running a store node's lifecycle script, set NODE_PATH to the host package's store node_modules so a script-invoked bin can resolve the host's sibling deps:

if (isInStore) {
  const storeNodeModules = resolve(path, ...name.split('/').map(() => '..'))
  env.NODE_PATH = [storeNodeModules, process.env.NODE_PATH].filter(Boolean).join(delimiter)
}

NODE_PATH is fallback-only (can't shadow working resolution), added only to the script's env (never process.env), and scoped to the store-local node_modules — install-time only, runtime isolation untouched.

Tests

• test/arborist/reify.js: regression test asserts a linked store node's script env NODE_PATH points at the store node_modules. Fails before, passes after.
• Full @npmcli/arborist suite passes at 100% coverage.

References

Fixes #9549