[ump45nose]

Fixes #10182

What

npm install-scripts ls / prune missed prepare on git dependencies when the tree was loaded from node_modules/.package-lock.json. That hidden lockfile omits script bodies and often omits hasInstallScript for prepare-only git deps, so prune deleted a still-needed allowScripts entry and ls hid the package.

Why this approach

loadActual({ forceActual: true }) does recover scripts, but it also drops resolved for those nodes, which breaks git policy matching (github:owner/repo#sha). Instead, extend the existing read-only package.json disk hydration in getInstallScripts so non-registry nodes are checked even when hasInstallScript is absent. Registry behavior is unchanged.

Tests

• arborist unit: prepare-only git dep hydrates prepare from disk without hasInstallScript
• install-scripts prune keeps a git prepare allowScripts entry under a hidden lockfile
• install-scripts ls lists that git prepare dep under a hidden lockfile

tap workspaces/arborist/test/install-scripts.js --grep='prepare-only git'
tap test/lib/commands/install-scripts.js --grep='git prepare'

AI disclosure

This change was written with AI assistance. I reviewed every line, ran the tests above, and chose disk hydration over forceActual after verifying that forceActual clears resolved and breaks git allowScripts matching.

[ump45nose]

Pushed a follow-up for the CI failures on this branch:

• Lint: removed the extra blank line in test/lib/commands/install-scripts.js.
• approve-scripts linked-store case: disk script recovery was gated on hasNonRegistryShape / isRegistryDependency. Linked-store Node subclasses expose isRegistryDependency as a boolean false by default, so empty store-root inventory entries entered recovery and hit the hasInstallScript sentinel ((install scripts present)), showing up as unreviewed under a registry pin. Recovery now keys off the resolved URL only, and the sentinel is emitted only when hasInstallScript === true.

Local: arborist install-scripts unit tests (incl. a new store-root regression) and CLI install-scripts / approve-scripts suites are green.