fix(agent-terminal): approve node-pty install scripts for npm 12

[backnotprop]

Problem

On npm 12 the managed agent-terminal runtime installs but cannot run.

npm 12 no longer runs dependency lifecycle scripts (preinstall, install, postinstall, and implicit node-gyp builds) unless the installing project approves the package by name in an allowScripts field. node-pty 1.1.0 ships prebuilds for darwin-arm64, darwin-x64, win32-arm64 and win32-x64 only, so on Linux its install script is the thing that compiles build/Release/pty.node.

writeRuntimePackageJson generated a manifest with no allowScripts, so npm install --omit=dev ... @plannotator/webtui@0.1.0 skipped node-pty's scripts, exited 0, and left a runtime with no native binary. The failure only surfaced later, when opening the Agent tab, as "Agent terminal runtime could not load WebTUI". The provisioning failure that did exist was worded as "Skipping agent terminal runtime install", which reads like a benign skip rather than a broken runtime.

Reported by @smartobc-stephen, with the npm warning text, the node-pty resolution paths, and the local repair steps all included. That report is what made this diagnosable without an npm 12 machine.

Changes

packages/server/agent-terminal-runtime.ts

• buildAgentTerminalRuntimePackageJson() (extracted from writeRuntimePackageJson) now emits "allowScripts": { "node-pty": true } alongside the existing pinned @plannotator/webtui dependency.
• verifyAgentTerminalNativeBinary(runtimeDir) runs after npm install and before the existing WebTUI import preflight. It mirrors node-pty's own resolution order from lib/utils.js (build/Release, build/Debug, then prebuilds/<platform>-<arch>) and looks for pty.node.
• A failed check triggers one targeted npm rebuild node-pty and re-verifies. If the binary is still absent, provisioning fails with a message that names npm's script blocking and gives the exact repair command, instead of returning a runtime that looks installed.

packages/server/agent-terminal-runtime.test.ts

• The generated manifest carries the node-pty approval and nothing else.
• The native-binary check passes on a compiled build/Release and on a matching platform prebuild.
• A node-pty directory with no pty.node produces the actionable error.
• A tree with no node-pty at all is left alone.

On the proposed fix

Taken, with one amendment. The proposal used a version-pinned key, "node-pty@1.1.0": true. npm matches allowScripts keys as exact strings, with no semver range support, and @plannotator/webtui depends on node-pty: ^1.1.0. The managed runtime installs with no lockfile, so the first node-pty patch release would make a pinned entry stop matching and silently reintroduce this exact bug. The name-only form keeps matching and is still narrow: exactly one package, never a blanket allow. node-pty is also the only package in that tree with lifecycle scripts, so one entry is sufficient.

The field is inert on older npm, which ignores unknown top-level manifest keys. Verified on npm 11.12.1: npm install accepts the manifest without a warning and preserves the field when it rewrites package.json.

Verification

• bun test packages/server/agent-terminal-runtime.test.ts packages/server/agent-terminal.test.ts: 14 pass, 0 fail.
• bunx tsc --noEmit -p packages/server/tsconfig.json: clean.
• End to end on macOS arm64 with npm 11.12.1: installAgentTerminalRuntime() against a temp PLANNOTATOR_DATA_DIR returns installed, the written manifest keeps allowScripts, and the native check passes via the darwin-arm64 prebuild. The existing working path is unchanged.
• bun test packages/server/ has 18 pre-existing failures in this environment (missing apps/pi-extension/generated/* vendored files and no sem sidecar). Confirmed identical on the base commit with the change stashed.

Runtime coverage

Bun only. The managed runtime provisioning in packages/server/agent-terminal-runtime.ts has no Pi mirror: apps/pi-extension declares @plannotator/webtui as a direct dependency of the extension itself and imports it in process, so it never generates a runtime manifest. apps/pi-extension/vendor.sh vendors packages/core/agent-terminal.ts (types and layout helpers), not this file. Nothing to change on the Pi path.

Not done

• No Linux npm 12 CI job. The release workflow's smoke_test_agent_terminal already runs install-runtime agent-terminal on Linux, so it will start failing loudly once runners ship npm 12, which is the behavior the issue asked for. A dedicated pinned-npm-12 matrix leg is a separate change.
• The pre-existing "Skipping agent terminal runtime install" wording on the other failure paths is left alone; only the new native-binary failure uses the clearer "Agent terminal runtime install failed" prefix.

Closes #1409

AI-assisted (Claude) under maintainer direction.