[BUG] Verbose and duplicate entries in `allowScripts` created when `install-strategy=linked`

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

When using install-strategy=linked and adding a package to allowScripts I get weird output:

{
	"allowScripts": {
		"file:../../../vue-demi@0.14.10-pGPQNZuy2Yfs8dw1nOAidw/node_modules/vue-demi": true,
		"file:../../../esbuild@0.28.2-5fSWMmpOnxTxpz8DaF55tQ/node_modules/esbuild": true,
		"file:../../esbuild@0.28.2-5fSWMmpOnxTxpz8DaF55tQ/node_modules/esbuild": true
	}
}

Expected Behavior

When not using a linked install strategy I get concise entries, without duplicates (see the difference for esbuild)

{
	"allowScripts": {
		"vue-demi@0.14.10": true,
		"esbuild@0.28.2": true
	}
}

Steps To Reproduce

1. Create a clean project
2. Add install-strategy = "linked" to the .npmrc
3. Install esbuild
4. Run npm install-scripts approve esbuild
5. Look at the state of allowScripts in package.json

Environment

• npm: 11.19.0
• Node.js: 26.7.0
• OS Name: macOS Sequoia 15.7.9
• System Model Name: Macbook Pro
• npm config:

; "user" config

; min-release-age = 14 ; overridden by project

; "project" config

install-strategy = "linked"
min-release-age = 14

; node bin location = /Users/name/.nvm/versions/node/v26.7.0/bin/node
; node version = v26.7.0
; npm local prefix = /Volumes/projects/project
; npm version = 11.19.0
; cwd = /Volumes/projects/project
; HOME = /Users/name
; Run `npm config ls -l` to show all defaults.

Reproduce the issue with install-strategy="linked" in .npmrc, install esbuild, and run npm install-scripts approve esbuild. Inspect how the command updates allowScripts in package.json and compare linked and non-linked entries. Done means linked installs produce concise package-version entries without duplicate paths.