fix(node): resolve global roots from developer home

[raysubham]

What does this PR do?

• Resolves macOS and Linux user-scoped Node global roots from executor.ResolveHome, so an elevated service scans the detected developer home instead of the service process home.
• Preserves Windows USERPROFILE, explicit npm/pnpm prefix overrides, and existing package parsing behavior.
• Adds a regression covering npm, pnpm, and Yarn when service HOME=/root and the developer home is /home/testuser.

Type of change

• Bug fix
• Enhancement
• Documentation

Testing

• Tested on macOS (version: 26.5.2)
• Binary runs without errors: ./stepsecurity-dev-machine-guard --verbose
• JSON output is valid: ./stepsecurity-dev-machine-guard --json | python3 -m json.tool
• No secrets or credentials included
• Lint passes: make lint
• Tests pass: make test

Additional validation:

• Focused and detector race suites
• Full go test -race ./...
• go vet ./... and go mod tidy -diff
• Smoke tests: 45/45
• CGO-disabled Linux, macOS, and Windows cross-builds
• Windows detector test compilation
• Gosec: 24 existing findings, none introduced by this change

Native Windows CI and the Developer MDM Linux rerun remain pending.