[martinrrm]

Summary

Bring the dependency fixes from #10152 to release/v11 using the released, Node-compatible maintenance versions:

Package	Previous	Updated	Upstream fix
bin-links	6.0.2	6.0.3	Normalize bin metadata in getPaths() (npm/bin-links#189).
@npmcli/promise-spawn	9.0.1	9.0.2	Decode escaped Windows executable tokens (npm/promise-spawn#172).
pacote	21.5.1	21.5.2	Verify registry manifest identity for signature/attestation verification (npm/pacote#521).

Update the bundled release contents and lockfile, and raise the direct dependency minimums for @npmcli/promise-spawn and pacote. bin-links remains a transitive dependency. Runtime dependency maps and supported Node versions are unchanged.

Validation

Passed on Node 24.15.0 using this branch's npm and branch-local development dependencies:

• Root: focused install, ci, exec, and audit command tests, plus root eslint.
• Arborist: focused node, arborist/reify, and arborist/rebuild tests, plus workspace eslint.
• libnpmexec: focused run-script, registry, and local tests, plus workspace eslint.
• git diff --check; exactly three dependency commits; bundled and locked versions agree with registry metadata and integrity values; runtime consumers resolve the updated branch-local packages; no lockfile package additions/removals or unrelated version changes.

Focused tests disable coverage and do not establish full-package coverage or full CI readiness. Full suites, template-oss postlint, other consumer workspace suites, native Windows behavior, and the multi-platform/Node matrix and smoke/publish-dry-run checks remain outside this local validation scope.