Firebase App Hosting build fails to install private GitHub package despite valid NPM token and .npmrc setup

### [REQUIRED] Environment info

**firebase-tools:**
13.10.1

**Platform:**
macOS (M1 Max, Node.js v22.x)

---

### [REQUIRED] Test case

I'm trying to deploy a Next.js 15 project to Firebase **App Hosting**, and this project depends on a private GitHub package published to GitHub Packages (e.g., `@xxxxxxxxxx/xxxxxx`).

To install the private package during build, I created a Firebase secret called `npm-token` and configured my `apphosting.yaml` like this:

```yaml
env:
- variable: NPM_TOKEN
secret: npm-token
availability:
- BUILD
```

I also added a custom `buildCommand` to generate `.npmrc` dynamically:

```yaml
scripts:
buildCommand: |
echo "@xxxxxxxxxx:registry=https://npm.pkg.github.com" > .npmrc
echo "//npm.pkg.github.com/:_authToken=${NPM_TOKEN}" >> .npmrc
echo "always-auth=true" >> .npmrc
cp .npmrc $HOME/.npmrc
cat $HOME/.npmrc || echo "no .npmrc"
npm config list
npm ci
npm run build
```

This setup works perfectly on my local machine. However, the same configuration fails when building via Firebase App Hosting.

---

### [REQUIRED] Steps to reproduce

1. Create a Next.js 15 project with a private GitHub dependency (e.g., `@ xxxxxxxxxx/xxxxx`).
2. Add a valid `npm-token` secret to Firebase.
3. Add the `.npmrc` creation logic and `env` config to `apphosting.yaml`.
4. Run `firebase deploy` to trigger a build on App Hosting.

---

### [REQUIRED] Expected behavior

Firebase App Hosting should install the private GitHub package using the configured `.npmrc` and token from the secret manager without any issues—just like it works locally.

---

### [REQUIRED] Actual behavior

The build fails with the following error:

```
Module not found: Can't resolve '@xxxxxxxxxx/xxxxx'
```

Despite all environment variables and `.npmrc` logic being properly set, Firebase App Hosting appears to either ignore `.npmrc`, misinterpret the token, or has a network/auth-related limitation during build.

---

### Additional Notes

- The token used is a **classic GitHub PAT** with `read:packages` and `repo` scope.
- Locally, the `.npmrc` logic and the same token install the package without any issue.
- I've also tried manually authenticating with `.npmrc` variations, but the result is the same in App Hosting.
- There's no clear documentation or example for installing private GitHub packages using App Hosting + secret manager.

---

### Request

Please confirm if:

1. Firebase App Hosting supports private GitHub package installs via `.npmrc`.
2. There's an undocumented limitation or workaround required.
3. App Hosting intentionally blocks access to external private package registries during build.

If this is a bug or documentation gap, a fix or clarification would be greatly appreciated.