fix: stop test fixtures from deleting the repository's dependencies

Four fixtures linked the installed dependencies into a throwaway root with a
single directory symlink at <fixture>/node_modules, then ran pnpm inside that
root. pnpm does not recognise the modules directory it finds there and purges
it; with CI=true it does so without a prompt. The purge followed the symlink and
deleted the repository's own node_modules mid-run, so a test suite uninstalled
the workspace it was running in. That is what produced the cascading,
file-unrelated failures a full test:unit run reported, and it happened twice
while running the suites for the adapter re-review.

scripts/lib/fixture-node-modules.ts replaces all four sites: node_modules is a
real directory whose entries are individual symlinks, so a recursive delete
unlinks the fixture's own links instead of walking through one link into the
shared tree. Resolution is unchanged.

tests/unit/fixture-node-modules.test.ts performs the exact recursive delete pnpm
performs and asserts the source tree survives, and check:adapter-inventory now
fails on any reintroduction of the directory-symlink form — verified by putting
the old line back and watching the gate reject it.

A full tests/unit + tests/integration run now leaves the dependencies intact.
removal-fixture, supply-chain and security-followup-archive, the three suites
that had to be excluded before, pass in that run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/integration/security-followup-archive.test.ts

@@ -1,5 +1,5 @@
 import { spawnSync } from "node:child_process";
-import { cp, mkdir, mkdtemp, readFile, rm, symlink, writeFile } from "node:fs/promises";
+import { cp, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
@@ -15,6 +15,7 @@ import {
   RELEASE_CANDIDATE_MANIFEST_PATH,
   releaseCandidateManifestSchema,
 } from "../../scripts/lib/release-candidate.ts";
+import { linkFixtureNodeModules } from "../../scripts/lib/fixture-node-modules.ts";
 
 it(
   "builds a real candidate assessment and passes the default archived verifier from the captured archive",
@@ -43,7 +44,7 @@ it(
         recursive: true,
         force: true,
       });
-      await symlink(path.join(sourceRoot, "node_modules"), path.join(fixtureRoot, "node_modules"), "dir");
+      await linkFixtureNodeModules(fixtureRoot, sourceRoot);
       const git = spawnSync("git", ["show", "-s", "--format=%H%n%ct", "HEAD"], {
         cwd: sourceRoot,
         encoding: "utf8",