[BUG] `npm i --package-lock-only` executes scripts and crashes

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Executing npm install --package-lock-only on a source tree can fail if the package defines a prepare script which requires dependencies.

NPM trying to execute any scripts in this scenario doesn't make sense as dependencies can't possible be available due to the --package-lock-only flag.

Expected Behavior

According to the manual The --package-lock-only argument will only update the package-lock.json, instead of checking node_modules and downloading dependencies.

If node_modules are not installed, it doesn't make any sense to execute scripts because scripts might have dependencies which are not installed.

Steps To Reproduce

$ git clone https://github.com/ferdium/ferdium-app --branch v6.0.0 --depth 1
$ cd ferdium-app
$ npm install --package-lock-only

> ferdium@6.0.0 prepare
> is-ci || husky install

sh: line 1: is-ci: command not found
sh: line 1: husky: command not found
npm ERR! code 127
npm ERR! path /tmp/ferdium-app
npm ERR! command failed
npm ERR! command sh -c is-ci || husky install

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/grmpf/.npm/_logs/2022-12-20T08_59_23_786Z-debug-0.log

Environment

• npm: 9.1.3
• Node.js: v18.12.1
• OS Name: NixOS
• npm config:

; "project" config from /tmp/ferdium-app/.npmrc

engine-strict = true
frozen-lockfile = false
legacy-peer-deps = true
save-exact = true
save-prefix = ""
shamefully-hoist = true
unsafe-perm = true

; "cli" config from command line options

location = "project"

; node bin location = /nix/store/7ppnyqmp1c92gkfrixbz99sw7q6ifkg1-nodejs-18.12.1/bin/node
; node version = v18.12.1
; npm local prefix = /tmp/ferdium-app
; npm version = 9.1.3
; cwd = /tmp/ferdium-app
; HOME = /home/grmpf

Start by reproducing npm install --package-lock-only in the Ferdium v6.0.0 source tree and inspect the prepare script execution shown in the report. Trace the npm CLI path for this flag; done means the lockfile is updated without running package scripts when dependencies are unavailable.