Update npm plugin to fix double temp file read issue

[dalldrit13]

Overview

I originally introduced this plugin in #658

While recently using the plugin I discovered an issue with the temp file approach related to consuming more than once.

This arose in version pinning of package managers.

When a version of npm or pnpm is specified inside the package.json

e.g.

{
  "packageManager": "pnpm@11.24.0"
}

and this version differs from the global version on the system, the default behaviour is corepack downloads that missing version and spawns a child process using that version.

So the process looks like

1Password
  └─ pnpm 11.24 bootstrap process
       └─ pnpm 11.22 actual command process

The issue here is the temp file 1Password creates is only readable once as a stream. The parent process consumes it, then the child attempts to read it also and hangs indefinitely.

This also occurs with other double read cases (see testing)

This resolves that issue by instead leveraging env vars which do persist to the child process.

Type of change

• Created a new plugin
• Improved an existing plugin
• Fixed a bug in an existing plugin
• Improved contributor utilities or experience

How To Test

With the previous version of the plugin built you can reproduce the issue with the following

Repro Example 1

1. Create an empty dir
2. Add a package.json file
3. Populate with

   {
     "name": "npm-fifo-repro",
     "version": "1.0.0",
     "private": true,
     "scripts": {
       "preinstall": "npm whoami"
     }
   }

4. Run npm install

Repro Example 2 (pnpm)

assuming your global pnpm version !== 11.22.0 (otherwise just alter packageManager so not equal to global version)

1. Create an empty dir
2. Add a package.json file
3. Populate with

   {
     "name": "pnpm-fifo-repro",
     "version": "1.0.0",
     "private": true,
     "packageManager": "pnpm@11.22.0"
   }

4. Run pnpm whoami

Both of these configurations should not hang after rebuilding this version of the plugin

Changelog

Switch to env based approach for npm plugin, resolving file drain process hang issue.

[scottisloud]

No concerns - Custom provisioner looks straightforward and aligns with many other existing provisioner patterns, so not requesting additional security review.

LGTM