fix(perf): lazy load arborist and pacote in libnpmexec - #10096

Related: #10084 (Windows shims start node once per call) and #10097 (does
not list network interfaces at start-up). Each removes a different part of npm's start-up cost;
they touch different files and the savings add up.

Summary

npx <bin> / npm exec -- <bin> with <bin> already in node_modules/.bin (npx tsc,
npx eslint, npx vitest run …) loads 560 modules before it spawns the bin. About 420 of
them are @npmcli/arborist and pacote and what they pull in: all of pacote's fetchers,
make-fetch-happen, @npmcli/agent, sigstore/tuf-js, cacache, tar… That path uses none
of them. libnpmexec requires both at the top of lib/index.js, and the only call on this path,
hasPkgBin(), goes through pacote.manifest(dir) just to read the project's package.json.

This PR, in workspaces/libnpmexec/lib/index.js:

1. Requires @npmcli/arborist and pacote on first use, and
   ./strict-allow-scripts-preflight.js (which reaches into Arborist) where it is called. This is
   the approach of fix: lazy loading of arborist and pacote #6225 and fix(perf): lazy loading optimizations #7388 for lib/commands/*, applied to libnpmexec, which they did not
   touch.
2. hasPkgBin() calls PackageJson.normalize(dir) directly. That is what pacote's
   DirFetcher.manifest() does for a directory spec; pacote only adds _resolved/_integrity/
   _from, which hasPkgBin does not read. Because pacote is no longer involved, the
   allowDirectory option it used to be passed has nothing to gate.
3. npm exec --call / npx -c without --package runs the command before
   Arborist.loadActual(). With no packages, the loaded tree was never read.

With the patch, npx <local bin> and npx -c <cmd> load 140 modules. Arborist and pacote load
exactly as before whenever a package has to be looked up or installed.

Numbers

• Setup:
  • npm 12.2.0 from npm pack of latest (b317f16), against the same tarball with this commit;
  • official Node.js 26.7.0; Windows 11; i9-14900K;
  • a Dev Drive (ReFS), and the system drive (NTFS, Defender real-time scanning);
  • node npx-cli.js … directly (no shim), in a TypeScript project.
• Method: 20 interleaved passes after warm-up; medians in ms, and the paired per-pass
  difference with its 95% CI.

tsc --version itself takes 73 ms and node -e 0 45 ms on this machine, so npm's own share of
npx tsc --version goes from about 470 to about 200 ms on the Dev Drive. A second run, in a clean
user environment and with the machine under more load, saved more: 318 ms (303–336) on the Dev
Drive and 518 ms (505–552) on the system drive.
The module and fs call counts, before and after, are the same on Windows and on Linux, where the
change was also tested.

Behaviour

• Unchanged: every path that needs a package lookup or install (registry specs, --package,
  directory specs, the npx cache, global bins).
• hasPkgBin: reads the same normalized package.json as before.
• One edge: a corrupt node_modules used to make npx -c '<cmd>' fail inside loadActual();
  now it runs the command, as npm run does.

Tests

• New: workspaces/libnpmexec/test/local.js › "call without packages does not load the local
  tree". It counts loadActual() calls through the existing Arborist mock pattern, and fails
  without change 3.
• Windows 11, Node 26.7.0:
  • node . run test -w workspaces/libnpmexec: passes, 100% coverage;
  • node . run lint: clean;
  • node . run test: passes except test/bin/windows-shims.js, test/lib/commands/publish.js
    and test/lib/commands/stage/index.js, which fail the same way on unmodified latest on the
    test machine (a PowerShell profile message, and scripts that call touch).
• Linux: libnpmexec passes with 100% coverage.

Composition

• Merges cleanly with fix: start node once per call in the Windows npm/npx shims #10084, fix(powershell): avoid evaluating CLI paths as source #10058 and fix(perf): do not list network interfaces when loading config definitions #10097, in any order.
• Overlaps textually with the open libnpmexec PRs fix: refresh npx cache for local bin changes #9767, fix(libnpmexec): honor min-release-age-exclude in npx #9768, fix(libnpmexec): honor min-release-age-exclude when resolving specs #9944 and fix(exec): don't inherit global config when installing to the npx cache #10042 in
  workspaces/libnpmexec/lib/index.js: the top-of-file requires and the pacote.manifest /
  new Arborist call sites. The rebase is mechanical whichever lands first (Arborist →
  getArborist(), pacote → getPacote()).

References

• fix: lazy loading of arborist and pacote #6225, fix(perf): lazy loading optimizations #7388: lazy loading of Arborist/pacote and other modules in the CLI.
• [BUG] npm exec --workspaces very slow #5509: npm exec overhead, "the overhead of loading every npm dependencies".
• fix: start node once per call in the Windows npm/npx shims #10084: Windows shims, one node start per call.