Renovate's lock file maintenance fails with EALLOWREMOTE on the lockfiles that hold npm #505

What happened

Renovate's weekly lock file maintenance (#502) fails its renovate/artifacts check with EALLOWREMOTE. It fails for the three lockfiles that hold the npm package: package-lock.json (through @semantic-release/npm), e2e/pod/servers/pivot/package-lock.json and e2e/pod/servers/nss/6/package-lock.json:

Refusing to fetch "https://registry.npmjs.org/npm/-/npm-11.21.1.tgz"

The repository uses npm 12 (packageManager: npm@12.2.1), which by default fetches no package that a URL names (allow-remote=none). Renovate locks with npm install --package-lock-only. That command opens every package with bundled dependencies by its registry URL, and it does so without the exemption a registry tarball gets elsewhere. This is an npm bug, npm/cli#9800. Its fix, npm/cli#9819, is in no npm release yet.

Expected: lock file maintenance locks every lockfile again from scratch, as it did before npm 12. As long as it fails, the lockfiles don't move, and fixes in transitive dependencies don't arrive. Any Renovate update that moves npm itself fails the same way.

A plain npm install, and an update that keeps the lockfile, are not affected. Contributors don't see the bug.

Steps to reproduce

1. With npm 12.2.1 and the repository's .npmrc, delete package-lock.json (or e2e/pod/servers/pivot/package-lock.json, or e2e/pod/servers/nss/6/package-lock.json).
2. Run npm install --package-lock-only in that directory.
3. See EALLOWREMOTE: npm refuses to fetch the npm tarball from registry.npmjs.org.

Where

Renovate's renovate/artifacts check on #502 (lock file maintenance)

Version

4515e96

Browser and system

No response

Pod

No response

The app's language

None

Anything else

#503 proposes a workaround for Renovate's runs only. It gives Renovate's npm allow-remote=all in renovate.json5, with npmrcMerge: true, so each directory's .npmrc still applies (min-release-age=3, ignore-scripts=true). Contributors' npm keeps npm 12's default. Both settings come out once an npm release fixes npm/cli#9800.

After the fix is merged, tick the rebase/retry box on #502 so that Renovate runs its artifacts again.