[martinrrm]

Summary

Narrow v10 adaptation of the alias identity/authentication correction in #9921.

• Derive the extraction package name from valid dependency specifications rather than the installed alias slot or package-controlled metadata.
• Preserve scoped registry authentication for aliases shared with ordinary dependencies, regular peers, and optional peers.
• Carry that identity through both linked-install transformations.
• Match v10's existing override semantics: bundled and shrinkwrapped dependencies use the raw specification.
• Preserve the existing extraction fallback when the dependency identity is absent, non-registry, or ambiguous.

Backport scope

This targets release/v10. It is not a full cherry-pick of #9921, which targets latest and is still open.

npm 10 does not have the newer allow-remote policy feature. This PR therefore does not introduce remote-policy enforcement or exemptions, sibling-path metadata verification, additional metadata requests, configuration changes, dependency upgrades, or generated/bundled dependency changes.

Regression coverage

Nine mocked-registry integration scenarios cover hoisted and linked installs, ordinary consumers, regular and optional peers, and global alias installation. A token scoped to the registry's /npm/ path must accompany the sibling-path tarball request. Deliberately misleading lockfile/package metadata cannot select the credential scope.

Identity tests cover aliases, peer and project/workspace precedence, conflicting selections, non-registry specifications, linked transformations, and v10 override/bundle/shrinkwrap behavior.

Validation

• Before the fix, the eight original local/linked integration scenarios fail because the tarball request lacks the expected scoped authorization header.
• Final focused checks pass on Windows with Node 22.23.4: all nine integration scenarios, all 26 identity assertions, and owning-package ESLint.
• git diff --check passes.
• Full Arborist tests were attempted with coverage retained, but the locally reused development tooling encounters Windows fixture/socket errors and native Node crashes. The same No socket was returned in the connect() function failure and native exit reproduce on the clean v10 base commit a8804198f147914cab2fc25f6d48535f13621b9a.
• Full-suite success/coverage and the supported Node/OS CI matrix are not established locally.
• Template-oss postlint is blocked by the local tooling mismatch: v10 pins 4.29.0, while the reused checkout has 5.1.1. No generated files, coverage settings, or dependencies were changed to bypass these checks.

Draft pending review and validation with the maintenance branch's matching tooling/CI.