arborist: sanitize packageName in path construction for linked strategy

[KevinZhao]

Summary

Add sanitizeName() to strip path traversal sequences (../) from package names before using them in filesystem path construction in isolated-reifier.js.

Package names from package-lock.json are used directly in path.join() calls, which resolves ../ sequences. This adds sanitization at all 9 locations where packageName is interpolated into paths.

Changes

• Add sanitizeName() helper that replaces ../ with _ and strips leading /
• Apply to: getKey(), #generateChild(), #externalProxy(), #assignCommonProperties(), createIsolatedTree(), #processEdges(), #processDeps()

Test plan

• sanitizeName("../../../../tmp/foo") returns ____tmp/foo
• sanitizeName("@scope/name") returns @scope/name (scoped packages unaffected)
• sanitizeName("normal-package") returns normal-package (no-op for valid names)

[wraithgar]

This diff includes formatting changes from the project linter (prettier)

You're gonna need to undo this in order for us to review this. The cli has its own linting rules and linter.

[KevinZhao]

Done — force-pushed a clean commit. The diff now contains only the sanitizeName logic changes (12 insertions, 8 deletions). All formatting noise has been removed.

[wraithgar]

This problem is solved elsewhere by using @npmcli/name-from-folder. Our pretend nodes need this, and probably need a better packageName getter.

[KevinZhao]

Thanks @wraithgar — rewritten to use @npmcli/name-from-folder as suggested.

The pretend node packageName getter in #assignCommonProperties now derives the name from node.path via nameFromFolder, falling back to node.packageName and node.name. This ensures path-safe names at the source rather than sanitizing at each usage point.

The diff is now just 3 lines changed (1 import + 2 logic changes) using the existing @npmcli/name-from-folder dependency.