fix(cli): scope install-scripts warning to packages touched by this reify

[Sanjays2402]

Description

npm update -g <pkg> (and other partial installs) warns about install scripts that are "blocked" on pre-existing global packages that this run never touched. Example from the issue:

$ npm install -g --allow-scripts=opencode-ai opencode-ai
$ npm install -g --allow-scripts=yarn yarn
$ npm update -g --allow-scripts=opencode-ai opencode-ai
npm warn install-scripts 1 package had install scripts blocked because they are not covered by allowScripts:
npm warn install-scripts   yarn@1.22.22 (preinstall: ...)

yarn is already installed, already sitting on disk, and npm update -g opencode-ai is not going to run its scripts this session. It gets flagged only because checkAllowScripts walks the entire actualTree after reify.

The strict-allow-scripts preflight is intentionally whole-tree (it hard-fails installs), so I left that alone. This change only tightens the advisory warning shown after a successful reify.

Fix

In lib/utils/reify-finish.js, after collecting unreviewed nodes, filter them against the set of locations that appear as ADD or CHANGE in arb.diff. Untouched packages don't run install scripts this reify, so we don't flag them. When there is no diff (defensive fallback), behavior is unchanged.

Existing Issue

Fixes #9797

Screenshots

Not applicable, terminal warning output change only.

Test Coverage

Added three new subtests to test/lib/utils/reify-finish.js:

• unreviewed packages are filtered to nodes actually touched by this reify (added / changed) so untouched globals are no longer warned about
• when arb.diff is absent, behavior falls back to the previous whole-tree list
• the diff walker traverses CHANGE actions, nested children, and tolerates nullish diff entries

I verified both directions: the new tests fail on main (untouched packages still leak through) and pass with this patch. reify-finish.js stays at 100% line / branch / function / statement coverage. Only changed files were linted (eslint clean).

AI disclosure

This change was written with the assistance of Claude. I have reviewed the diff and the tests and take responsibility for the code.