only specify npm.prefix as gentlyRm base when it is inside folder path

[phated]

Possible fix for #6850

Thanks @othiym23 for the guidance.

[othiym23]

I need to review this one pretty carefully, and maybe write a couple more tests, but I'll try to land this for this week's release. @iarna, can you double-check @phated's logic here and make sure it makes sense to pass in the unbuilt folder like this?

[othiym23]

Landed as 29a6ef3 (a semicolon snuck in!). I still need to write a bunch of unhappy-path tests around this, but I looked it over and I think this is probably not a lot more dangerous than what we had before (and is a lot less dangerous than what we had before I rewrote gently-rm.js in the first place.

Thanks, @phated!