Pass --ignore-scripts flag when installing with pnpm - #16

Summary

Closes #15. pnpm install fails when installing packages with unapproved build scripts, exiting non-zero: [ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: [email protected].

Root cause: Please look into the issue #15 for detailed explanation. In short, Laravel\Chisel\Node\Npm::install() runs the command from PackageManager::installCommand(), which for pnpm is bare (no --ignore-scripts): PackageManager.php#L28. laravel/installer avoids this failure by passing the --ignore-scripts flag explicitly in NodePackageManager::installCommand(), which chisel doesn't. so anything driven through Chisel hits it. and this issue applies to pnpm 11+ only.

Why this issue has been silent until now

This is not any regression. it has been latent since pnpm 11, because in practice nothing ever reached Chisel's pnpm branch. Let me explain.. Chisel resolves the package manager from disk: a non-npm lock file, otherwise the manager token in the dev/dev:ssr/setup Composer scripts, otherwise npm. When a starter kit's install:features hook runs during laravel new, the app has just been created. it then carries the kit's committed package-lock.json and a composer.json still saying npm, because the installer didn't rewrite those scripts until after the hooks had already run (explained in laravel/installer issue #561).
So Chisel always resolved to the default package manager npm, no matter what --pnpm/--bun/--yarn the user had passed. npm has no "build-approval gate", so the bare command (npm install) always exited 0 in that case..

I reached this issue while fixing that ordering bug (issue #561) in the laravel/installer (opened PR #563). So, when I applied the fix, once composer.json reflects the correct selected manager before the hooks run, Chisel correctly resolves to pnpm, and then this failure surfaces on the very first install.
So, the laravel/installer fix didn't cause the failure; rather it's simply the first thing that ever routes a real install through this code path, which was routed wrongly to the default package manager until now. This issue is equally reachable even without that fix: run php artisan install:features manually in any project that already has a pnpm-lock.yaml.

Changes I made

This PR just passes the --ignore-scripts flag to the pnpm install command. this-

• matches what laravel/installer (src/Enums/NodePackageManager.php) already does.
• is supported across all pnpm versions.
• doesn't break any steps; verified on laravel/react-starter-kit: lint, format, wayfinder generation, and build all passed with the flag.
• handles the unapproved build script like it was supposed to do.

I left the other commands (other than pnpm install) untouched for now..

Updated test dataset to cover the newly added flag for pnpm install command.