fix(arborist): scope named updates to selected workspaces - #10091

Problem

On npm 12.2.0, a named update scoped to one workspace also eagerly updates valid, independent root and sibling-workspace dependencies with that installation name. This reproduces with ordinary packages; it is not specific to aliases.

Given a valid lockfile and these disjoint ranges:

Command: npm update semver --workspace=scope-a --package-lock-only.

The named-update queue walks the entire inventory, and problem-edge evaluation independently forces every matching installation name to refresh. Filtering only the queue is insufficient because the root is always evaluated.

Change

• Compute the requested dependency scope once after applying all user requests, reusing the existing workspace/root dependency-set helpers.
• Apply the same scope to named queueing, edge evaluation, optional-peer shortcut bypass, and placement update hints.
• Preserve selected transitive updates, including replacements, local Link targets, and existing dependency subgraphs newly adopted by replacements. Newly reached nodes can be re-evaluated even if already visited outside the selected scope.
• Follow normal local links in the disabled-workspace dependency-set helper; continue excluding workspace-only dependencies.
• Leave missing/invalid-edge repair and unfiltered/global named-update behavior intact.

This is named updates only, not a redesign of bare npm update / update: true. Shared dependencies and changes required to repair invalid or peer relationships are not promised to remain byte-identical.

Verification

• Twelve behavioral regression cases cover workspace/root selection, unfiltered updates, invalid root repair, replacement/adopted dependencies, cyclic registry and local-link graphs, absent optional peers, disabled-workspace boundaries inside newly adopted graphs, and existing/new local links.
• Full Arborist suite on Linux/Node 24.21.0: 59 files, 5,147 assertions passed, three platform-specific skips; 100% statements, branches, functions, and lines. The default coverage gate remains enabled.

npm test --workspace=@npmcli/arborist --ignore-scripts -- --reporter=terse
npm exec --workspace=@npmcli/arborist -- eslint \
  lib/arborist/build-ideal-tree.js lib/arborist/index.js test/arborist/build-ideal-tree.js

• Actual published npm 12.2.0 CLI before/after probe produced the semver table above. Both starting and resulting graphs passed npm ci and real module calls; manifests and ci lockfile bytes stayed unchanged.
• Final runtime probe updated workspace micromatch 3.1.10 → 4.0.5, adopted the root's existing braces@3.0.2, then correctly updated its newly reachable fill-range 7.0.1 → 7.1.1. Independent workspace fill-range@6.0.0 stayed locked. Fresh npm ci, glob/range function calls, and manifest/lock checks passed.
• Composition with fix(arborist): preserve explicit npm alias target identities #10090 also passed an actual CLI update/ci/runtime check: root debug → ms@2.0.0 unchanged, selected ms → npm:is-number 1.0.0 → 7.0.0, unselected ms → npm:is-odd@2.0.0 unchanged.

The branch is synchronized with latest at b317f16c80df02ea3628cfa77170d5ae9b59720c through a history-preserving merge. The review diff contains only the four intended Arborist files; release-bookkeeping changes are no longer included. It does not contain or require #10090 for the ordinary-package scoping fix. Both changes are needed for the composed alias isolation scenario.

Current head: 483252fc38ef72d146513c17e8d6c834a4a4889f. Actual CLI checks passed independently and composed on this current base. Hosted npm workflows require maintainer approval (action_required); these local results do not claim that the hosted matrix has run.