fix(allowScripts): close three enforcement gaps (#9652)

Three allowScripts (install-script policy) fixes:

- Version-pinned deny fails closed when the lockfile omits `resolved`.
- `npm link <pkg>` gates the global install of a missing package.
- Regression test: bundled-dep scripts stay blocked under the gate.