[BUG] allow-git=root does not work for overrides

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

allow-git=root does not work for overrides. This requires us to use allow-git=all which is subideal.
affected commands are at least install and ci

Expected Behavior

Since overrides is manually defined (like dependencies etc), using allow-git=root should allow those packages to work? Maybe it's by design, but then I'd still like a way to use them without having to specify all

Steps To Reproduce

1. Use this package.json:

{
  "name": "npm-allow-git",
  "private": true,
  "overrides": {
    "ssh2-sftp-client": {
      "ssh2": "github:mscdex/ssh2#45522bb8723d8ecf459a1d222086e56074c11682"
    }
  }
}

2. npm install ssh2-sftp-client --allow-git=root

Output on my machine is:

npm error code EALLOWGIT
npm error Fetching non-root packages of type "git" have been disabled
npm error Refusing to fetch "ssh2@github:mscdex/ssh2#45522bb8723d8ecf459a1d222086e56074c11682"

Note: this reproduction is a "simple" package, ie package.json and package-lock.json are in the same directory. But I ran into this issue in a monorepo, where the overrides are defined in a different package.json than the one that lists each package's direct dependencies. This should also be very easy to reproduce by using the above package.json for the workspace root, add some workspaces to it, then npm install the overridden dependency into one of the workspaces, if not let me know and I'll add a repro for that variant too.

Environment

• npm: 12.0.2
• Node.js: v26.8.1
• OS Name: ArchLinux
• System Model Name: ThinkPad T14
• npm config:

; "user" config from /home/bbq/.npmrc

fund = false

; node bin location = /usr/bin/node
; node version = v26.8.1
; npm local prefix = /home/bbq/gits/barbeque-squared/npm-allow-git
; npm version = 12.0.2
; cwd = /home/bbq/gits/barbeque-squared/npm-allow-git
; HOME = /home/bbq
; Run `npm config ls -l` to show all defaults.

Start with the provided package.json and reproduce the failure using npm install ssh2-sftp-client --allow-git=root; compare how the allow-git check classifies the git dependency introduced through overrides. Done means override-provided root git packages work with allow-git=root while non-root git packages remain blocked, including for npm install and npm ci.