4.4.1 - setup installs with a clean environment

4.4.1 — setup installs with a clean environment

Running setup through npx — the documented way — put the parent npm's resolved configuration
into npm_config_* variables, and the nested npm install inherited them. With an npm that
supports an allowScripts switch the child aborted with:

EALLOWSCRIPTS: --allow-scripts is not allowed in project-scoped installs

so the install was skipped (only a warning said so) and you were told Next: npm install && npm run snapshot — a first-time user hitting the one thing setup exists to do.

The nested run now gets the caller's environment minus npm_config_* and npm's lifecycle
variables, so it reads the project's own .npmrc and flags.

A recording package-manager shim on PATH, with npm_config_allow_scripts=1 in the environment,
pins it: the shim is invoked and none of npm's config reaches it. The test fails without the fix.

Verified: npm run verify green — lint 105 files, 506 tests / 502 pass / 0 fail / 4 host
skips, tarball 23 files; the same suite on Node 18.20.4 and 20.19.4 (501 pass, 0 fail); and the
fixed binary installs and generates with a deliberately polluted environment:
✅ Installed dependencies (npm install, 1.1s) → Next: npm run snapshot.