fix(coding-agent): apply allow-remote overrides for self-update via npm 12

[awhite0030]

Root cause: npm >= 12 defaults allow-remote to none, which rejects installations directly from a release tarball URL. The self-update command previously did not provide any policy override when using the direct package artifact spec, which caused the update process to abort with an EALLOWREMOTE error.
Fix: Updated makeSelfUpdateCommandStep to accept an optional env argument and merge it into the step execution in runSelfUpdate. When detecting a direct package artifact update via npm, it injects npm_config_allow_remote=all and npm_config_allow_scripts=<tarball_path> as environment variables, mirroring the behavior added to install.sh in PrimeIntellect-ai#1992.
Validation: Ran a focused regression test 2163-npm12-self-update.test.ts via Vitest asserting the correct env properties are attached to the command step for direct tarball updates and excluded for registry specs. Also ran npm run check which passed.
Upstream discussion: PrimeIntellect-ai#2163

---

PR created automatically by Jules for task 8586885732343917656 started by @awhite0030

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[awhite0030]

Upstream comment draft (discussion PrimeIntellect-ai#2163):

---

Investigated this report and produced a candidate fix, validated on a fork of this repository.

Root cause, fix and validation from the working notes:

Root cause: npm >= 12 defaults allow-remote to none, which rejects installations directly from a release tarball URL. The self-update command previously did not provide any policy override when using the direct package artifact spec, which caused the update process to abort with an EALLOWREMOTE error.
Fix: Updated makeSelfUpdateCommandStep to accept an optional env argument and merge it into the step execution in runSelfUpdate. When detecting a direct package artifact update via npm, it injects npm_config_allow_remote=all and npm_config_allow_scripts=<tarball_path> as environment variables, mirroring the behavior added to install.sh in PrimeIntellect-ai#1992.
Validation: Ran a focused regression test 2163-npm12-self-update.test.ts via Vitest asserting the correct env properties are attached to the command step for direct tarball updates and excluded for registry specs. Also ran npm run check which passed.
Upstream discussion: PrimeIntellect-ai#2163

Diff: main...fix/npm12-self-update-allow-remote-8586885732343917656
Full pull request: #69

The change passes npm run check and the focused regression tests against current main. If a fix for this is still wanted, I can open a pull request.

---

not posted (daily cap reached (2/2))

[google-labs-jules]

Upstream comment draft (discussion PrimeIntellect-ai#2163):

---

Investigated this report and produced a candidate fix, validated on a fork of this repository.

Root cause, fix and validation from the working notes:

Root cause: npm >= 12 defaults allow-remote to none, which rejects installations directly from a release tarball URL. The self-update command previously did not provide any policy override when using the direct package artifact spec, which caused the update process to abort with an EALLOWREMOTE error.
Fix: Updated makeSelfUpdateCommandStep to accept an optional env argument and merge it into the step execution in runSelfUpdate. When detecting a direct package artifact update via npm, it injects npm_config_allow_remote=all and npm_config_allow_scripts=<tarball_path> as environment variables, mirroring the behavior added to install.sh in PrimeIntellect-ai#1992.
Validation: Ran a focused regression test 2163-npm12-self-update.test.ts via Vitest asserting the correct env properties are attached to the command step for direct tarball updates and excluded for registry specs. Also ran npm run check which passed.
Upstream discussion: PrimeIntellect-ai#2163

Diff: main...fix/npm12-self-update-allow-remote-8586885732343917656
Full pull request: #69

The change passes npm run check and the focused regression tests against current main. If a fix for this is still wanted, I can open a pull request.

---

not posted (daily cap reached (2/2))

Acknowledged.