Handle npm v12 changes

NPM v12 makes some breaking changes to its default behaviour for improved security.

https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/

Specifically, it won't run npm scripts by default when installing modules. This is good for security, tricky for us.

I've examined the current state of the Node-RED library ecosystem to find there are 72 packages with install scripts. preinstall=14 install=9 postinstall=53. This only covers the top-level module - not the dependency trees. To disable scripts would risk breaking these nodes.

We have two choices.

Enable scripts by default

Essentially, maintain the existing behaviour for our users. This is the easy option; but that doesn't mean its the right option.

Update install workflow to include a script check

There is a good reason for disabling scripts by default. The npm cli will provide ways to approve scripts. We could update the install workflow to handle getting the user's consent before running any scripts. Not straight-forward to do. As far as I can tell, you have to run the npm install then check to see if there are any pending scripts. This will mean the files are on disk and can be loaded - node doesn't block the require/import if the scripts haven't run yet. Should NR refuse to start flows if there are pending scripts? Lots of lifecycle things to consider.