npm's lifecycle subcommands are never routed to rtk

Type: Enhancement (coverage gap) · Severity: Medium (lost savings) · Area: src/discover/rules.rs

Summary

The npm rule matches only ^npm\s+(exec|run|run-script|rum|urn|x), so the subcommands an agent
runs most often fall through to the native binary unfiltered:

This is a rule gap, not a filter gap: npm_cmd::KNOWN_SUBCOMMANDS already lists install, ci,
test, audit, outdated and friends precisely so that run is not injected for them. The
filter was built to handle these; nothing ever sent them its way.

Why it matters

npm install is among the noisiest commands in a JS project — dozens of npm WARN deprecated
lines, EBADENGINE blocks, funding notices — wrapped around two lines that actually matter
(how many packages were added, and how many vulnerabilities were found).

Environment

• rtk 0.42.4 (develop @ 29f9bb7)

Start in src/discover/rules.rs and inspect the existing npm rule alongside npm_cmd::KNOWN_SUBCOMMANDS. Verify that npm test, install, ci, audit, outdated and ls are routed through rtk without injecting run, then confirm the existing npm filtering behavior still applies to those commands.