fix(arborist): do not hoist undeclared workspaces in linked strategy

[manzoorwanijk]

In continuation of our exploration of using install-strategy=linked in the Gutenberg monorepo, which powers the WordPress Block Editor.

Summary

With install-strategy=linked, all workspace packages are unconditionally symlinked into the root node_modules/, regardless of whether the root declares them as dependencies. This defeats the strict isolation that the linked strategy is supposed to provide — any workspace can import any other workspace without declaring it as a dependency.

The root cause is two-fold:

1. assignCommonProperties() includes all workspaces in root's localDependencies because npm auto-creates type: 'workspace' edges from root to every workspace
2. createIsolatedTree() unconditionally creates a workspace Link entry in root.children at node_modules/<wsName> for every workspace

The fix:

1. Filters undeclared workspace deps in #assignCommonProperties() so they don't enter root's localDependencies
2. Only creates root-level workspace symlinks (node_modules/<wsName>) for declared dependencies

Before (broken)

node_modules/@scope/a -> packages/a    # root doesn't depend on @scope/a
node_modules/@scope/b -> packages/b    # root doesn't depend on @scope/b

After (fixed)

packages/a/node_modules/@scope/b -> packages/b   # @scope/a depends on @scope/b

No symlinks at root node_modules/ since root doesn't depend on either workspace.

References

Fixes #9072
Related to #6537 (same problem with --install-strategy=nested)