fix(arborist): honor gypfile:false on lockfile-driven installs

[lazerg]

Summary

gypfile: false opts a package out of the node-gyp rebuild install script npm synthesises when it finds a binding.gyp. That opt-out only survives when the tree node was built from a packument or read off disk. Nodes built from a lockfile carry no gypfile field at all, so on npm ci, or on any npm install with an existing package-lock.json, npm sees the binding.gyp and adds the script anyway.

With better-sqlite3@13.0.2 that shows up as a spurious install-scripts warning. It is not only cosmetic: the synthesised script is real, so once it is covered by allowScripts (or on npm 10, which has no such gate) node-gyp rebuild actually runs against a package that ships prebuilt binaries and asked not to be rebuilt.

Both the script enumeration in install-scripts.js and the build set in rebuild.js now read the opt-out back from the installed package.json when the node itself does not know it.

Fixes #9837

Testing

Against the repro in the issue, npm ci no longer warns, and npm ci --dangerously-allow-all-scripts --foreground-scripts no longer invokes node-gyp. Added regression tests for both paths.