fix: disable npm workspaces with env and --workspace flag

npm still reads workspace package.json even with cwd=/tmp because
it uses HOME-based global configs. Set NPM_CONFIG_WORKSPACES=''
and pass --workspace= to fully disable workspace resolution.

npm_install.py

@@ -2230,9 +2230,14 @@ def _build_frontend(src_frontend: Path, dest_frontend: Path):
                     if DEBUG:
                         print(f"   ⚠ 'yarn set version' failed: {e}")
             
-            # METHOD 3: npm install @yarnpkg/cli (yarn 4.x) — run from /tmp to avoid reading workspace package.json with patch: entries
+            # METHOD 3: npm install @yarnpkg/cli (yarn 4.x)
             try:
-                subprocess.run(["npm", "install", "-g", "@yarnpkg/cli"], check=False, cwd="/tmp")
+                env = os.environ.copy()
+                env["NPM_CONFIG_WORKSPACES"] = ""
+                subprocess.run(
+                    ["npm", "install", "-g", "@yarnpkg/cli", "--workspace="],
+                    check=False, cwd="/tmp", env=env,
+                )
                 
                 if shutil.which("yarn"):
                     major = _get_yarn_major_version(["yarn"])
@@ -2249,14 +2254,24 @@ def _build_frontend(src_frontend: Path, dest_frontend: Path):
             # First install yarn 1.x if not present
             if not shutil.which("yarn"):
                 try:
-                    subprocess.run(["npm", "install", "-g", "yarn@1"], check=False, cwd="/tmp")
+                    env = os.environ.copy()
+                    env["NPM_CONFIG_WORKSPACES"] = ""
+                    subprocess.run(
+                        ["npm", "install", "-g", "yarn@1", "--workspace="],
+                        check=False, cwd="/tmp", env=env,
+                    )
                 except Exception:
                     pass
             
             if shutil.which("yarn"):
                 try:
                     # Uninstall any global yarn 4.x first
-                    subprocess.run(["npm", "uninstall", "-g", "@yarnpkg/cli"], check=False, cwd="/tmp")
+                    env = os.environ.copy()
+                    env["NPM_CONFIG_WORKSPACES"] = ""
+                    subprocess.run(
+                        ["npm", "uninstall", "-g", "@yarnpkg/cli", "--workspace="],
+                        check=False, cwd="/tmp", env=env,
+                    )
                     
                     # yarn 1.x can upgrade itself to 4.x
                     result = subprocess.run(