feat(devicepolicy): support managed npm settings

[raysubham]

What does this PR do?

• Adds strict optional npm settings validation and deterministic rendering to the package-config policy.
• Reconciles settings through the existing DMG and MDM ownership paths while preserving reversible clear behavior and secret-free aggregate observation.
• Fails closed on unsafe mixed ownership, insecure settings-aware MDM metadata, ambiguous npm syntax, and invalid policy value shapes.

Type of change

• Bug fix
• Enhancement
• Documentation

Testing

• Tested on macOS (focused and full race suites)
• Binary runs without errors: ./stepsecurity-dev-machine-guard --verbose
• JSON output is valid: ./stepsecurity-dev-machine-guard --json | python3 -m json.tool
• No secrets or credentials included
• Lint passes: go vet ./... and golangci-lint run
• Tests pass: go test -race ./...
• Windows device-policy test binary cross-compiles

Native Windows execution is left to CI. The agent version remains unchanged; 1.17.0 is a release-time bump.

Related Issues

N/A