[BUG] `allowScripts` and its tooling ignored when `ignore-scripts=true` in `.npmrc`

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

With ignore-scripts=true in ~/.npmrc OR ./.npmrc - the following behavior is observed:

$ npm approve-scripts --allow-scripts-pending
No packages with unreviewed install scripts.

• no scripts can be identified or added to allowlist

$ npm ci --foreground-scripts

• no scripts run even with "allowScripts" correctly specifieed in package.json

Expected Behavior

npm approve-scripts Should list scripts pending for approval, thus enabling migration from the configuration where scritps were ignored to a configuration with an allowlist.

Should manage and execute the allowlist even if ignore-scripts=true is still set (to avoid falling back to running all scripts when npm is accidentally downgraded)

[!CAUTION]
Being able to keep ignore-scripts=true in .npmrc while using the allowlist is the only way to avoid defaulting to running all install scripts whenever use of Node.js version managers or system path tweaks or adding new team members causes someone to run an older version of npm

Steps To Reproduce

1. set up the situation:

package.json

{
  "name": "test",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "keywords": [],
  "author": "",
  "license": "ISC",
  "dependencies": {
    "not-really-a-package": "^1.1.0"
  },
  "devDependencies": {
    "@lavamoat/preinstall-always-fail": "^1.0.3"
  }
}

~/.npmrc OR ./.npmrc

ignore-scripts=true

2. Attempt to manage and execute lifecycle scripts

Environment

$ npm --version
11.16.0

Reproduce the behavior using the package.json and .npmrc examples, then run npm approve-scripts --allow-scripts-pending and npm ci --foreground-scripts with ignore-scripts=true. Trace the approve-scripts and ci entry points to determine how allowScripts is handled when scripts are ignored. Done means pending scripts can be approved and the allowlist can control execution without removing ignore-scripts=true.