[martinrrm]

Summary

Update three bundled runtime dependencies to their released patch versions:

Package	Previous	Updated	Upstream fix
bin-links	7.0.0	7.0.1	Normalize bin metadata in getPaths() (npm/bin-links#187).
@npmcli/promise-spawn	10.0.0	10.0.1	Decode escaped Windows executable tokens (npm/promise-spawn#166).
pacote	22.0.0	22.0.1	Verify registry manifest identity for signature/attestation verification (npm/pacote#516).

Validation

Passed using the checkout's npm through the local verification runner:

• Root: focused install, ci, exec, and audit command tests, plus root eslint.
• Arborist: focused node, arborist/reify, and arborist/rebuild tests, plus workspace eslint.
• libnpmexec: focused run-script, registry, and local tests, plus workspace eslint.
• git diff --check; exactly three dependency commits; installed and locked versions match; no lockfile package additions/removals or unrelated version changes.

Focused tests disable coverage and do not establish full-package coverage or full CI readiness. Full suites, template-oss postlint, other consumer workspace suites, native Windows behavior, and the multi-platform/Node matrix and smoke/publish-dry-run checks remain outside this local validation scope.