fix(lambda-nodejs): copy .npmrc for pnpm to enable private registry authentication

[sebastianplesciuc]

Issue # 36567

Closes #36567

Reason for this change

When using nodeModules with pnpm, CDK creates a pnpm-workspace.yaml in the bundling directory (added in #21911). This causes pnpm to treat the bundling directory as a standalone workspace root, which prevents it from inheriting .npmrc configuration from parent directories. This breaks authentication for packages from private registries.

Description of changes

When pnpm is detected and nodeModules is specified, copy the project's .npmrc (if it exists) to the bundling directory alongside pnpm-workspace.yaml. This allows pnpm to find auth tokens for private registries.

Describe any new or updated permissions being added

N/A

Description of how you validated changes

• Added unit test 'pnpm with nodeModules copies .npmrc for private registry authentication'
• All existing tests pass (120/120)

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

✅ A exemption request has been requested. Please wait for a maintainer's review.

[sebastianplesciuc]

Exemption Request

This fix modifies the Docker bundling command to copy .npmrc when using pnpm with nodeModules. Integration test snapshots only capture CloudFormation templates, not bundling commands - the bundling command is executed at synth time and only the resulting asset hash appears in the snapshot.

The fix is covered by a unit test that verifies the bundling command includes cp .npmrc when .npmrc exists. The existing integ.dependencies-pnpm.ts test validates pnpm bundling works correctly.

[sebastianplesciuc]

PR Update: Changed approach from file copy to base64 encoding

The initial implementation failed the integration test because it tried to copy .npmrc using a relative path. In Docker bundling, only projectRoot is mounted as /asset-input, so when .npmrc is outside projectRoot (common in pnpm monorepos where .npmrc is at workspace root), the file copy fails with "No such file or directory".

New approach

• Read .npmrc content at CDK synth time
• Base64 encode it and embed in the bundling command
• Decode at runtime using echo '<base64>' | base64 -d > .npmrc

This works because:

1. The file is read during synth (when it's accessible), not during Docker bundling
2. Base64 avoids shell escaping issues with special characters in .npmrc (quotes, tokens, etc.)
3. Works for both local and Docker bundling

Testing

• Unit tests pass
• Integration test (integ.dependencies-pnpm.js) ran successfully locally and snapshot is unchanged
• Added .testnpmrc fixture file for unit testing