fix: dedupe allowScripts keys under install-strategy=linked

[lazerg]

Summary

Under install-strategy=linked every dependency is reached through a symlink, and npm install-scripts approve <pkg> matched those link nodes along with the real package. A link's only identity is the relative path it points at, so each one wrote its own file:... key, and a package reachable at two symlink depths got two entries. The link groups also ran last and dropped the correct name@version pins as stale.

Those file: keys never match anything at install time either, because the policy gate walks link targets rather than the links themselves, so the package stayed blocked right after being approved.

findNodesForArgs now skips links, the way collectUnreviewedScripts and npm install-scripts prune already do. Local file: dependencies keep working, since their identity node is the link target, which still carries the file:../pkg spec through linksIn.

Testing

Added an install-strategy=linked fixture where the same package is linked from the root and from another package's store entry, asserting a single canvas@1.0.0 entry. Also added a local file: dependency case guarding the existing file:../local key.

Fixes #9939