; Third-party install scripts do not run, here or on a CI runner holding the
; checkout. `04-scanner-design.md` §329 makes "no code execution from scanned
; source" a critical rule for this product; a build lane that executes arbitrary
; postinstall hooks is the same exposure one step to the left.
;
; ⚠ THIS REPLACES A CONTROL THAT WAS NEVER WIRED. `site/package.json` carried
; `"allowScripts": {"esbuild": true}` — the @lavamoat/allow-scripts policy field
; — since v0.5.0, with no lavamoat in the tree, no devDependencies and no
; .npmrc. It read as a control and enforced nothing, which is worse than having
; none. The lockfile declares install scripts for esbuild and fsevents.
;
; Measured before landing: with scripts disabled, `npm ci && npm run build`
; produces a BYTE-IDENTICAL dist (same sha256 over every file). esbuild resolves
; its binary through the @esbuild/linux-x64 optional dependency, so the
; postinstall is a no-op here, and fsevents is macOS-only.
ignore-scripts=true
