Prune source-proven npm cache children from generic scans

[newtv-ai]

Summary

Avoid redundant generic per-file traversal of the exact npm provider children _cacache, _npx, and _tuf while preserving diagnostic, unknown, redirected, and filesystem-boundary visibility.

Change

• Add a constant-cost npm_generic_scan_skip_paths() proof using the bound npm CLI, live version-aware config, exact source rules, and stable local filesystem identities.
• Reuse the persistent/security path boundary set hardened in Guard npm vendor mutations against redirected persistent state #197/Extend npm protected mutation path guards #198; a child overlapping any protected path is not pruned.
• Prove each child independently as a normal local fixed directory, so symlink/junction/reparse/cloud/inaccessible objects remain visible to the generic scanner.
• Never prune _logs or unclassified cache-root state.
• Do not call npm cache ls, npm cache npx ls, recursive size inventory, or any mutation command for scan pruning.
• Wire only reachable source-proven child paths into the normal product scan exclusions; if npm proof fails, fall back to the ordinary full scan.

Non-goals

No TOOL/USER/KEEP lane changes, no raw npm filesystem authority, no new cleanup action, no npm reclaim quantification, no whole-cache category pruning, and no mutation-command changes.

Audit: docs/npm-source-proven-scan-pruning-audit.md.

Merge gate

Merge only from the exact final head after lock/dependency checks, Ruff, strict mypy, full pytest, Windows EXE build/upload, and CodeQL are all green.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.