* fix(install): persist revoked builds to .modules.yaml (#12221)
After a build-script dependency whose approval was revoked (e.g. via
git stash dropping allowBuilds from pnpm-workspace.yaml) is re-added,
the revocation detection populated ignoredBuilds in memory but the
install path's writeModulesManifest had already run, so .modules.yaml
never recorded the revoked packages. pnpm approve-builds then read an
empty ignoredBuilds and reported 'no packages awaiting approval'.
Re-read the manifest from disk after the revocation scan and write
back the updated ignoredBuilds, merging with any entries the install
path captured.
* refactor(install): address review comments
- Inline dead ignoredBuildsFromInstall indirection
- Drop unsafe allowBuilds cast in the regression test
---------
Co-authored-by: Zoltan Kochan <z@kochan.io>
