feat(pm): add vp pm approve-builds subcommand

[fengmk2]

Summary

Adds vp pm approve-builds — a unified subcommand for approving dependency lifecycle scripts (install/postinstall). Mirrors pnpm approve-builds one-to-one, adapts to bun pm trust, and falls back to informative warn-and-noop on npm/yarn.

Surface (intentionally tight, matches pnpm's documented flags):

vp pm approve-builds                       # interactive (pnpm)
vp pm approve-builds esbuild fsevents      # approve named packages
vp pm approve-builds esbuild !core-js      # pnpm >= 11.0.0 (deny syntax)
vp pm approve-builds --all                 # pnpm >= 10.32.0 / bun
vp pm approve-builds -- <raw args>         # forward to underlying PM

Cross-PM behavior

PM	Behavior
pnpm	Pass-through. --all gated on >= 10.32.0, !pkg deny syntax gated on >= 11.0.0 (per pnpm PR #11030). Prereleases (10.32.0-rc.0, 11.0.0-beta.1) satisfy via Version::parse("<floor>-0") comparison.
bun	bun pm trust [--all] [pkgs...]. !pkg tokens emit a warn and are filtered (bun has no denylist model). When only deny tokens are given, the warn alone is enough — no redundant note.
npm	Warn + exit 0, pointing at ignore-scripts=true in .npmrc.
yarn	Warn + exit 0. Yarn 1 (Classic) gets an npm-style hint (lifecycle scripts run by default); Yarn Berry gets dependenciesMeta.<pkg>.built: true advice. Per yarn docs, enableScripts defaults to false in Berry.

Safety

• --all and positional packages are mutually exclusive at the clap layer (conflicts_with = "packages"). This prevents a silent override where --all !core-js on bun would warn "Skipping: core-js" then bun pm trust --all everything anyway.
• Version-gate failures render via Error::UserMessage (no harsh error: prefix).
• ApproveBuilds is not in the needs_project allowlist, so the npm/yarn/bun educational messages can fire outside a project directory.

Files

• Code: crates/vite_install/src/commands/approve_builds.rs (new), crates/vite_install/src/commands/mod.rs (export), crates/vite_pm_cli/src/cli.rs (variant + parse tests), crates/vite_pm_cli/src/handlers.rs (dispatch + error mapping)
• RFC: rfcs/approve-builds-command.md
• Snap tests:
  • Local: command-pm-approve-builds-{pnpm10,npm,yarn}/
  • Global: command-pm-approve-builds-{bun,pnpm10-old}/ (new)
  • Updated: snap-tests-global/cli-helper-message/snap.txt (for the new subcommand entry)

Test plan

• cargo test -p vite_install --lib approve_builds → 23/23
• cargo test -p vite_pm_cli --lib approve_builds → 8/8
• vp check --fix → 0 warnings/errors
• pnpm -F vite-plus snap-test-local approve-builds → 3/3 pass
• pnpm -F vite-plus snap-test-global approve-builds → 2/2 pass
• CI matrix verification

[netlify]

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	06be8c5
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a101f995482de00081a723d