lab: name the package registry by the address it names itself by, so npm 12 installs locked @novox packages (hq issue 624)

npm 12 installs a locked tarball only from its configured registry; the forge
writes every tarball URL, and so every lock file, at its public address, and
the lab named the registry by its forge setting's address. Every run stopped
at mesh-tools' install with EALLOWREMOTE.

modules/lab/test/runs.test.ts

@@ -251,3 +251,53 @@ test("the lab's tools bundle names its bound credential and binding in its env",
   assert.equal(env.MESH_LAB_FORGE_SECRET, m.secrets["npm-package-registry"]);
   assert.equal(env.MESH_LAB_FORGE_BINDING, m.binds["npm-package-registry"]);
 });
+
+// The next setup failure of novox/hq issue 624 (run-2026-10-13T13-15-26-634Z on shanks): npm 12 refused
+// mesh-tools' locked @novox/mesh-sdk with EALLOWREMOTE. The lab named the registry by its forge setting's
+// address (http://novox.internal:20000/…), the lock file holds the address the forge writes every tarball
+// URL at (https://git.novox.be/…), and npm 12 installs a locked tarball only from its configured registry.
+// A run names the registry by the address the registry names itself by.
+import { npmRegistry } from "../tools/runs.ts";
+
+function aRegistry(answer: () => Response | Promise<Response>): { get: typeof fetch; asked: string[] } {
+  const asked: string[] = [];
+  const get = (async (url: string | URL | Request) => {
+    asked.push(String(url));
+    return answer();
+  }) as typeof fetch;
+  return { get, asked };
+}
+
+const packument = (tarball: string) => new Response(JSON.stringify({
+  name: "@novox/mesh-sdk", "dist-tags": { latest: "0.1.14" },
+  versions: { "0.1.1": { dist: { tarball: "http://old.example/api/packages/novox/npm/x.tgz" } }, "0.1.14": { dist: { tarball } } },
+}), { status: 200, headers: { "content-type": "application/json" } });
+
+test("a run names the package registry by the address the registry gives its tarballs", async () => {
+  const r = aRegistry(() => packument("https://forge.example.org/api/packages/novox/npm/%40novox%2Fmesh-sdk/-/0.1.14/mesh-sdk-0.1.14.tgz"));
+  const got = await npmRegistry("http://novox.internal:20000/", r.get);
+  assert.deepEqual(got, { registry: "https://forge.example.org/api/packages/novox/npm/" });
+  assert.deepEqual(r.asked, ["http://novox.internal:20000/api/packages/novox/npm/@novox%2fmesh-sdk"]);
+});
+
+test("a registry that does not say its address leaves the forge's, and the reason is said", async () => {
+  for (const answer of [
+    () => new Response("not found", { status: 404 }),
+    () => packument("https://forge.example.org/elsewhere/mesh-sdk-0.1.14.tgz"),
+    () => new Response("{}", { status: 200 }),
+    () => { throw new Error("connect ECONNREFUSED"); },
+  ]) {
+    const got = await npmRegistry("http://novox.internal:20000", aRegistry(answer).get);
+    assert.equal(got.registry, "http://novox.internal:20000/api/packages/novox/npm/");
+    assert.match(got.problem ?? "", /did not say its own address/);
+  }
+});
+
+test("a run's npm configuration names the registry it was given, and the forge's own address only without one", () => {
+  const given = script("/work", "run-x", "http://novox.internal:20000", ["t.test.ts"], {}, undefined,
+    "https://forge.example.org/api/packages/novox/npm/");
+  assert.match(given, / '@novox:registry=https:\/\/forge\.example\.org\/api\/packages\/novox\/npm\/' > '\/work\/run-x\/\.npmrc'\n/);
+  assert.doesNotMatch(given, /@novox:registry=http:\/\/novox\.internal/);
+  const none = script("/work", "run-x", "http://novox.internal:20000", ["t.test.ts"], {});
+  assert.match(none, /'@novox:registry=http:\/\/novox\.internal:20000\/api\/packages\/novox\/npm\/'/);
+});