[TypeSpec Authoring][Security] Try .npmrc to use the same npm commands locally and in pipelines

Parent epic: #15730

Try using a checked-in `.npmrc` so that the **same npm/pnpm commands work in both local dev and the pipeline** — no pipeline-only setup steps, no divergent flags.

Why:
- Today, local and pipeline often diverge (e.g., different registries, different auth setup, different global vs local install patterns). Divergence makes it hard to reproduce pipeline failures locally and increases the chance of a bad command shipping only to CI.
- A repo-level `.npmrc` lets us pin registry, scope mappings, auth-token references, install behavior (e.g., `engine-strict`, `save-exact`, `prefer-frozen-lockfile`) once, in source control.

Scope:
- Add a repo-level `.npmrc` capturing the settings currently set ad-hoc in pipeline YAML.
- Reference auth tokens via env vars (e.g., `//registry.npmjs.org/:_authToken=${NPM_TOKEN}`) so secrets stay in the pipeline's secret store and never land in the file.
- Document the env vars required for local dev (and how to obtain them safely).
- Update pipelines to rely on `.npmrc` instead of inline `npm config set …` calls; the install command should reduce to the same `npm ci` / `pnpm install --frozen-lockfile` used locally.
- Verify pipelines pass; verify local dev still works after a clean clone.

Related: #15732 (remove `npm install -g` from pipelines) — both move us toward identical local/pipeline behavior.

Start by reading the pipeline YAML and locating the inline npm config setup and install commands. Compare those settings with the commands used in local development, then add the repo-level `.npmrc` and document the required environment variables. Done means local and pipeline installs use the same commands, secrets remain environment-backed, and both a clean clone and the pipelines work.

Written by the indexing model from the issue text.