Component install: branch on reference type — use npm install <pkg> for registry packages

The component installation process (introduced by [CORE-2824](https://harperdb.atlassian.net/browse/CORE-2824)) runs `npm install` inside the unzipped package directory for every deploy. This is npm's "source" installation flow — it installs `devDependencies` and runs the `prepare` script.

That's wrong for packages distributed via the npm registry (or other prepackaged URLs). Those are already "prepared" and should be installed via `npm install `, which uses npm's "production" flow: prod-only dependencies, no `prepare` script (same as how transitive dependencies are installed).

Easy repro: try to install a non-harper registry package like `ordered-binary` — runs through the wrong code path.

## Proposal (per Jira)

Align with npm's own branching by inspecting the `package` reference type:

- **Git remote URL reference** (`git+ssh://`, `org/repo`, etc.) → "source" flow:
- `npm pack ` to download.
- If `package.json#scripts.prepare` exists → `npm install` (consider `--production=false` to be explicit) so `devDependencies` install too.
- If no `prepare` script → `npm install --production`.
- **Registry / tarball URL reference** → "production" flow:
- `npm install ` into a temp directory.
- Move `temp-dir/node_modules/my-package` to the components directory.
- Move the remaining `temp-dir/node_modules` contents into `components/my-package/node_modules`.

## Acceptance criteria

- Registry-published components install via the production flow (no `devDependencies`, no `prepare`).
- Git-URL components continue to work via the source flow (with `prepare`/`devDependencies` as before).
- Test fixture covering both paths (a git-URL component and a registry-published component).
- Reference detection covers the common git-URL shapes: `git+ssh://...`, `git+https://...`, `org/repo`, `github:org/repo`, `gitlab:...`.

## Reference

[npm install docs](https://docs.npmjs.com/cli/v9/commands/npm-install)

---

🤖 Filed by Claude on behalf of Kris.