Staged publishing and new install-time controls for npm

npm CLI 11.15.0 ships two supply-chain security features. Staged publishing is now generally available: instead of immediately publishing a package, it goes into a queue requiring explicit 2FA-backed maintainer approval before becoming installable, even for CI/CD and OIDC trusted publishing workflows. Three new install-source flags — --allow-file, --allow-remote, and --allow-directory — join the existing --allow-git flag, letting teams restrict npm install from resolving dependencies from non-registry sources. Each flag accepts 'all' (current default) or 'none', and can be set in .npmrc or package.json. The --allow-git default will change to 'none' in npm v12.