fix(arborist): allow registry bundle inspection in dry runs

[yszgj-30]

Summary

• share the existing registry-resolved tarball validation between reification and ideal-tree building
• apply the registry tarball exemption when a complete ideal tree inspects bundled dependencies
• add a regression test for allowRemote=none

Root cause

Complete ideal-tree builds crack open tarballs for packages with bundled dependencies. That path passed the registry tarball URL directly to pacote.extract(), which classified it as a remote dependency and rejected it under the default allowRemote=none policy.

The fix only overrides that policy after the existing origin and registry-path checks confirm that the effective URL is registry-mediated.

Validation

• reproduced npm install --dry-run npm@11.10.0 --allow-remote=none failing with EALLOWREMOTE before the fix
• verified the same command exits 0 after the fix
• passed the focused ideal-tree regression test
• passed the existing 18-test registry URL and allowRemote reify group
• passed node . run lint -w @npmcli/arborist

Fixes #9800