fix(libnpmexec): honor min-release-age-exclude when resolving specs

[MrRio]

Description

npx resolves its spec with pacote.manifest, forwarding flatOptions.before (set by min-release-age). pacote knows nothing about min-release-age-exclude, so excluded packages still failed with ETARGET. npm install isn't affected because arborist drops before per-spec for exempted names.

This matters because it undermines the release-age protection itself: min-release-age-exclude exists so teams can keep a strict age window on third-party packages while still running their own trusted packages immediately. With npx ignoring it, the only workaround is --min-release-age=0, which turns the supply-chain safeguard off for the entire transitive tree instead of just the one exempted package.

This makes libnpmexec do the same before calling pacote.manifest, reusing arborist's release-age-exclude.js helper (isReleaseAgeExcluded + trustedSpecName, so npm: alias keys can't exempt the package they resolve to). The deep require follows the existing pattern in strict-allow-scripts-preflight.js; no new dependencies. The install into the npx cache already goes through arborist, so only the direct manifest lookup needed fixing.

Testing

Two tests added to workspaces/libnpmexec/test/registry.js: an excluded spec resolves and runs despite a past before cutoff (fails with ENOVERSIONS without the fix), and a non-excluded spec is still blocked.

Verified manually from this checkout against the public registry, using a package version published inside the age window (pnpm@11.25.0, published 2026-08-29):

Before this change, the exclude pattern is ignored:

$ node . exec --min-release-age=10 --min-release-age-exclude=pnpm --yes -- pnpm@11.25.0 --version
npm error code ETARGET
npm error notarget No matching version found for pnpm@11.25.0 with a date before 24/08/2026 ...

After this change, the same command resolves and runs:

$ node . exec --min-release-age=10 --min-release-age-exclude=pnpm --yes -- pnpm@11.25.0 --version
11.25.0

The filter itself still applies — dropping --min-release-age-exclude from the command above still fails with ETARGET after this change.

Fixes #9765

Alternative to #9768 — reuses arborist's helper instead of duplicating the minimatch logic in libnpmexec.

[MrRio]

@martinrrm would you be able to take a look at this as an approach? Making things tricky for our users without it as we want to protect them from supply chain attack risk