fix(arborist): only forward Link overrides when a rule names a target dep

[manzoorwanijk]

In continuation of our exploration of using install-strategy=linked in the Gutenberg monorepo, which powers the WordPress Block Editor.

npm ci in v11.14.x rejects lockfiles that v11.13.x accepts, with EUSAGE: Invalid: lock file's <pkg>@<old> does not satisfy <pkg>@<new> for any workspace ^ range that has had a newer matching patch published since the lockfile was generated.

Bisected to commit e7805c3 (#9198). The new Link.recalculateOutEdgesOverrides was forwarding the link's OverrideSet to the target unconditionally — even when the OverrideSet had no rule naming any of the target's deps. That set target.overrides from undefined to the root's generic OverrideSet, and the cascade caused canReplaceWith's "overrides equal" branch to flip placeDep's decision from KEEP to REPLACE for an edge the lockfile already satisfied. validateLockfile then rejected the resulting ideal tree.

Fixed by gating the forward on the OverrideSet actually containing a rule that names a dep the target depends on. If no rule matches, don't forward — target.overrides stays undefined and downstream placement matches v11.13.0.

#9198's intent is preserved: when the override DOES name a dep of the target, propagation still fires. #9198's existing test still passes (including bar edge spec is overridden to 2.0.0). Added a regression test for the no-matching-rule case; verified failing before this fix and passing after.

References

Fixes #9357
Refines #9198