Registry-listed nodes silently install unlisted node code via comfy-env

### Summary

Installing a registry-listed node through ComfyUI-Manager can pull in additional custom nodes that are not in the registry, never shown to the user, and not tracked by Manager. One node installed this way (ComfyUI-Env-Manager) contains an unauthenticated command-execution route (see PozzettiAndrea/ComfyUI-Env-Manager#5). This report is about the install path that puts unlisted code on the machine without the user choosing it, not the RCE itself.

### How it happens

- ComfyUI-SAM3, ComfyUI-SAM3DBody, ComfyUI-Sharp and ComfyUI-GeometryPack (same author) are listed in the Manager registry.
- Each ships a `comfy-env-root.toml` with a `[node_reqs]` section naming other GitHub repos as dependencies.
- The `comfy-env` package (currently 0.3.89), which these nodes depend on, `git clone`s every `[node_reqs]` entry straight into `custom_nodes/` at install/update time (`comfy_env/packages/node_dependencies.py`, `install_node_dependencies` / `clone_node`).
- ComfyUI-Env-Manager is one of those `[node_reqs]` entries and is **not** listed in the Manager registry. Checked the cached `custom-node-list.json`: zero matches for it, while the parent nodes are all present.

So a user installs a vetted, registry-listed node, and comfy-env side-loads an unvetted, unlisted node behind the registry's back. The same mechanism also pulled ComfyUI-DepthAnythingV3 and ComfyUI-Multiband onto my machine. I never saw or approved ComfyUI-Env-Manager.

### Why this matters for the registry model

Registry review and Manager's security-level controls only cover what's listed. A listed node that runs `git clone` on arbitrary repos during install routes around all of it. The cloned code isn't pinned to a reviewed version, isn't shown in the install dialog, and updates independently of anything Manager knows about.

### Suggestions

- Flag or reject registry nodes whose install/prestartup path `git clone`s other repos into `custom_nodes/`. At minimum surface it in the install dialog.
- If comfy-env-style dependency pulling is to be supported, require those dependencies to be registry entries that go through the same review and appear in the install list, rather than raw GitHub URLs cloned silently.
- Note that comfy-env re-clones a missing dependency, so disabling or removing a side-loaded node doesn't stick unless the parent is also stopped.

### Reproduce

Install ComfyUI-SAM3 (or -Sharp) through Manager on a machine with comfy-env, then look at `custom_nodes/` for ComfyUI-Env-Manager, ComfyUI-Multiband, etc. that were never selected.

Related: PozzettiAndrea/comfy-env#9 raises the opt-in/deployment side of comfy-env, but not the registry bypass or the fact that a side-loaded node carries an RCE.

Start with comfy_env/packages/node_dependencies.py, especially install_node_dependencies and clone_node, then reproduce by installing ComfyUI-SAM3 or ComfyUI-Sharp through Manager and inspecting custom_nodes/. Done should prevent unlisted repositories from being silently installed, or ensure such dependencies are surfaced and handled through the registry and install flow.

Written by the indexing model from the issue text.