chore: deny esbuild and fsevents install scripts (#2077)

npm 11.19 gates dependency lifecycle install scripts behind an
allowScripts allowlist and warns about any package not yet reviewed.
Three were pending: esbuild's postinstall and two copies of fsevents.

None of them is needed. esbuild resolves its platform binary through
optionalDependencies (@esbuild/darwin-*), so install.js is only a
validation/fallback-download step, and both fsevents copies ship a
prebuilt fsevents.node — their install script is just a node-gyp
rebuild fallback. Verified: builds and tests pass with the scripts
skipped.

Denying rather than approving keeps the warning quiet without granting
a standing "run this package's arbitrary install script" permission.


Claude-Session: https://claude.ai/code/session_01Gq5jMmxRUphrVbfNbYVmQH

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

package.json

@@ -103,5 +103,9 @@
     "**/*.{js,ts,jsx,tsx,json,md}": [
       "prettier --write"
     ]
+  },
+  "allowScripts": {
+    "esbuild": false,
+    "fsevents": false
   }
 }