npm workspace discovery walks into an in-workspace store

Describe the bug

npm workspace project discovery (pnpm_workspace::find_workspace_projects) prunes node_modules, bower_components and dot-prefixed directories, but not the directories pnpm itself manages: the store, the cache, the state directory. The ecosystem inventory that Cargo and Python discovery use (pnpm_workspace::find_workspace_inventory) already takes those as ignored_directories and skips them.

When storeDir points at a non-hidden directory inside the workspace and packages in pnpm-workspace.yaml has a pattern that reaches it, such as '**', every package.json under the store is discovered as a workspace project. The store holds file trees with their real names: the interpreters pnpm installs under <store>/python, the crate sources it caches, and, since pnpm/pnpm#15026, Python environment generations under <store>/python-envs. A package.json a wheel or a crate ships therefore becomes a workspace project, and a workspace project's own lifecycle scripts run without the dependency build approval that allowBuilds gates.

Expected behavior

npm project discovery skips the store, cache and state directories the way the ecosystem inventory does, whatever packages says.

Steps to reproduce

1. pnpm-workspace.yaml with storeDir: store, packages: ['**'] and python.enabled: true.
2. Depend on a wheel that ships a package.json with a prepare script.
3. pnpm install twice. The second install finds the package.json inside the environment generation under store/v11/python-envs/ and runs its script.

Notes

Found while reviewing pnpm/pnpm#15026, where the exposure through python-envs is new, but the interpreter and crate trees were already there. The fix belongs in find_workspace_projects: a FindWorkspaceProjectsOpts field for managed directories, threaded from Config at its four call sites.

---

Written by an agent (Claude Code, claude-fable-5-1).