Secure brew bundle npm installs

[MikeMcQuaid]

• Reuse Language::Node.local_npm_install_args so brew bundle npm installs get the same cooldown and script blocking used by formulae.
• Cover the command shape because package-manager installs otherwise drift from the hardened formula path without an obvious failure.

---

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you written new tests (excluding integration tests) for your changes? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) with your changes locally?

---

• AI was used to generate or assist with generating this PR.

OpenAI Codex 5.5 xhigh with local review and testing.

---

[Copilot]

Pull request overview

This PR hardens brew bundle’s npm package installation path by reusing Homebrew’s existing Node install-argument helper, aligning Bundle’s npm behavior with the more security-focused defaults used elsewhere in the codebase.

Changes:

• Use Language::Node.local_npm_install_args when running npm install -g from the Bundle npm extension.
• Update the Bundle npm spec to reflect the new command argument shape and prevent silent drift.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
Library/Homebrew/bundle/extensions/npm.rb	Switch npm installs to use Language::Node.local_npm_install_args for hardened defaults.
Library/Homebrew/test/bundle/npm_spec.rb	Adjust expected npm install invocation to include the shared Node install args.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.