chore(deps): drop the bundled npm CLI from the release tooling

eng/semantic-release-npm-disabled/index.js

@@ -0,0 +1,10 @@
+// semantic-release 25 depends on @semantic-release/npm, which installs a full npm CLI with its
+// own bundled dependencies. .releaserc.json lists its plugins explicitly and npm is not one of
+// them, so that plugin never runs here. package.json points the dependency at this directory to
+// keep the bundled copies (undici, ip-address, minimatch, ...) out of the tree (#460).
+//
+// Loading it is always a mistake: fail loudly instead of releasing without the npm step.
+throw new Error(
+  '@semantic-release/npm is disabled in this repository: CanKit.Pro does not publish to npm. ' +
+    'See eng/semantic-release-npm-disabled/index.js and issue #460.',
+);

eng/semantic-release-npm-disabled/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "@semantic-release/npm",
+  "version": "0.0.0-disabled",
+  "private": true,
+  "description": "Placeholder for @semantic-release/npm. CanKit.Pro never publishes to npm, so the real plugin and the npm CLI it bundles are not installed (#460).",
+  "license": "MIT",
+  "type": "module",
+  "main": "index.js",
+  "exports": "./index.js"
+}

eng/verify-release-config.mjs

@@ -30,6 +30,15 @@ const check = (what, id) => {
 
 for (const entry of config.plugins ?? []) {
   const [name, options] = Array.isArray(entry) ? entry : [entry, {}];
+
+  // package.json replaces @semantic-release/npm with a placeholder that throws when loaded, so
+  // the npm CLI it bundles stays out of the tree (#460). It resolves fine, so say it here.
+  if (name === '@semantic-release/npm') {
+    problems.push(`plugin ${name} is disabled in this repository (see eng/semantic-release-npm-disabled)`);
+    console.log(`DISABLED plugin ${name}`);
+    continue;
+  }
+
   check('plugin', name);
 
   const preset = options?.preset;