fix #3466: include bundledDependencies in workspace npm pack

[Amilliox]

The Problem

npm pack -w <workspace> omits bundledDependencies from the tarball when those dependencies are hoisted to the root node_modules.

Root Cause

When packing a workspace directory, pacotes DirFetcher loads an Arborist tree from the workspace path. Arborist cannot resolve hoisted bundled dependencies (edge.to === null), so npm-packlists gatherBundles skips them. Even if the edge were resolved, the relative path from workspace to a hoisted dep goes up (../../node_modules/...), producing invalid tarball entries.

The Fix

Before creating the tarball, libnpmpack creates temporary symlinks inside the workspaces node_modules for each bundled dependency, pointing to the hoisted location:

workspace/node_modules/ -> ../../node_modules/

This makes Arborist resolve the edges naturally and generates correct tarball paths (package/node_modules//file). Symlinks are cleaned up after packing.

Verification

• Existing test suite: 15/15 passed
• Workspace pack with bundledDeps: import-from now correctly included
• Regular pack (no workspace): no regression
• Workspace without bundledDeps: no unexpected files

Fixes #3466