[Failing test]: TypeScript deployment tests time out when npm audit endpoint stalls

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Build information

Build: https://github.com/microsoft/aspire/actions/runs/33826035047
Build error leg or test failing: Six TypeScript deployment jobs failed in attempts 1 and 2. An isolated third attempt reproduced the failure in `Deployment.EndToEnd-AzureSandboxesDeploymentTests`.

Affected jobs included Azure Sandboxes, TypeScript Express, TypeScript JavaScript Hosting, TypeScript Azure Container App Job, TypeScript VNet SQL Server Infrastructure, and AKS Cert Manager TypeScript. The .NET Azure Sandbox deployment test passed.

A preceding npm incident affected the Package installation component: https://stspg.io/n9gnn5fgb3x0

### Fill in the error message template

N/A. The actionable npm warning is emitted in collected Aspire CLI logs, while the test process reports a generic Hex1b timeout.

### Error details

```yml
Error Message:
Step 20 of 20 failed - WaitUntil("aspire add completion or version-selection prompt")
Timed out after 00:03:00 waiting for: aspire add completion or version-selection prompt

Stack Trace:
Hex1b.Automation.WaitUntilTimeoutException
at Hex1bAutomatorTestHelpers.cs:386
```

The isolated third rerun showed that `aspire init --language typescript --non-interactive` completed dependency installation in approximately 14 seconds. The subsequent `aspire add Aspire.Hosting.Azure.Sandboxes` invoked `npm install`, which ran for approximately five minutes. The test timed out after three minutes, but npm later exited with code 0.

The Aspire CLI log contained:

```text
npm notice This endpoint is being retired. Use the bulk advisory endpoint instead. See the following docs for more info: https://api-docs.npmjs.com/#tag/Audit

up to date in 5m
```

The runner image uses Node.js 22.23.2 and npm 10.9.8. A scheduled `main` deployment run using the same runner image completed equivalent npm installs in roughly 0.3 to 11 seconds before the npm incident: https://github.com/microsoft/aspire/actions/runs/33715044346

The PR does not modify the TypeScript dependency-installation implementation, and unrelated TypeScript deployment jobs failed through the same `npm install` path. This indicates an npm audit/advisory endpoint dependency rather than a Sandbox deployment regression.

We should determine whether Aspire can avoid this external failure mode. Options to evaluate include:

- Pass `--no-audit` when Aspire performs automatic npm dependency installation for generated TypeScript AppHosts.
- Set `NPM_CONFIG_AUDIT=false` only in deployment E2E infrastructure.
- Update or pin the npm toolchain to a version that no longer uses the retired endpoint.
- Preserve audit behavior but capture npm timing/debug logs and introduce targeted retry handling for upstream registry failures.

Increasing the generic Hex1b timeout alone is unlikely to be sufficient because it masks the external dependency and makes genuine failures slower.

### Standard output

Standard Output

```yml
[ScaffoldingService] Executing: /usr/local/bin/npm install
[ScaffoldingService] typescript/nodejs guest process exited with code 0 after approximately 14 seconds

[GuestAppHostProject] Executing: /usr/local/bin/npm install
[AppHost] npm notice This endpoint is being retired. Use the bulk advisory endpoint instead.
[AppHost] up to date in 5m
[GuestAppHostProject] typescript/nodejs guest process exited with code 0
```