…Scripts.ts

Ports four pnpm/test/install/lifecycleScripts.ts cases covering aube's
allowBuilds review machinery:

- L226: strictDepBuilds throws on unreviewed registry build scripts
- L260: review placeholder is auto-populated in package.json#aube.allowBuilds
- L268: placeholder merges with existing approvals in pnpm-workspace.yaml
- L303: strictDepBuilds still fails for packages with cached side-effects
  (regression for pnpm/pnpm#11035)

Bumps the lifecycleScripts.ts port count from 8/21 to 12/21. The
PNPM_TEST_IMPORT.md row now classifies the remaining 9 cases into
fixture-blocked, divergence, and equivalent-coverage buckets so future
ports don't re-discover the same blockers.

Two divergences worth noting in ports: aube writes the literal boolean
\`false\` for review placeholders (vs pnpm's \`"set this to true or false"\`
string), and aube's strict-dep-builds error reads "dependencies with
build scripts must be reviewed before install" (vs pnpm's "Ignored build
scripts:").

Two pnpm-parity wins:

1. allowBuilds review entries now write the canonical string
   "set this to true or false" (matching pnpm verbatim), not the
   bool `false` aube was emitting. Read-side recognizes the string
   in `aube-scripts::policy` and treats it as Unspecified (skip
   silently); strictDepBuilds still surfaces it via
   `unreviewed_dep_builds`. New `AllowBuildsWriteMode { Approve,
   ReviewPlaceholder }` enum on `add_to_allow_builds` makes the
   intent explicit at every call site.

2. `aube add --allow-build=<pkg>` (repeatable) pre-approves a dep's
   lifecycle scripts as part of the add. Writes
   `allowBuilds: { <pkg>: true }` before the install runs. Refuses
   to silently flip a pre-existing `false` (mirrors pnpm's conflict
   error verbatim).

Bats coverage: ports lifecycleScripts.ts L149 (selective build),
L164 (bare flag rejected), L347 (false-conflict error). Bumps the
lifecycleScripts.ts row in PNPM_TEST_IMPORT.md from 12/21 → 15/21
and drops the now-obsolete divergence notes (placeholder format,
--allow-build CLI flag).

Also addresses greptile's quote-fragility concern on the merge-test
assertion by switching from `assert_output --partial '<single-quoted>'`
to a quote-agnostic `grep -E "<key>['\"]?: <value>"` pattern.

…-wins precedence

Three bugbot fixes on top of the placeholder/--allow-build work:

- HIGH: AllowBuildRaw::from_json was JSON-encoding string values via
  Value::to_string, baking the outer quotes into the payload. Once
  the canonical "set this to true or false" placeholder was written
  to package.json, every subsequent install would read it back as
  the JSON-quoted form ("\"set this to true or false\""), miss the
  read-side equality check in aube-scripts::policy, and emit a
  spurious UnsupportedValue warning on every install. Same shape on
  the YAML side via WorkspaceConfig::allow_builds_raw — both paths
  now extract Value::String contents directly. Two regression unit
  tests pin the round-trip.

- LOW: apply_allow_build_flags merged manifest + workspace allowBuilds
  using or_insert (manifest wins), inverted vs build_policy_from_sources
  in install/lifecycle.rs (workspace wins). A pkg pinned to false in
  pnpm-workspace.yaml could be silently overridden by a true in
  package.json, defeating the conflict check the flag exists to enforce.
  Switched to insert so the install pipeline and the conflict check see
  the same effective value.

- MEDIUM: doc-comment fix — apply_allow_build_flags landed mid-way
  through lockfile_path_for_project's doc comment in the previous
  commit, splitting both into garbled fragments. Function moved
  above lockfile_path_for_project with its own intact doc.

Bugbot follow-up: --allow-build can write to a workspace yaml via
add_to_allow_builds, but --no-save's restore path snapshots only
package.json + the lockfile. Combining the two would leak an orphaned
approval into the workspace yaml. Same reasoning as the existing
--save-catalog / --no-save conflict (aube/src/commands/add.rs:39 prior
art); enforce it the same way via clap's `conflicts_with`.

Adds a bats regression test asserting clap rejects the combo before
any write.

Bugbot follow-up: the workspace-filter add path (`aube add
--filter=<sel> <pkg>` via `run_filtered`) silently dropped
`args.allow_build` — no conflict check ran and no approval was
written, so a user passing `--allow-build` under `--filter` would
believe the build was pre-approved when it was not.

Wire `apply_allow_build_flags` into `run_filtered`, targeting the
workspace root (`&root`) since `allowBuilds` is a workspace-level
setting. Runs before any per-package manifest mutation so a
conflict can't half-mutate child manifests, mirroring the contract
already enforced in the non-filtered path.

Adds a bats regression test exercising both legs (conflict + happy
path) under `--filter`.