[GHSA] GHSA-2rx9-3g3h-c2jv (high) — pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

GHSA-2rx9-3g3h-c2jv Severity: high CVE: None

pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

## Summary

A crafted lockfile alias could reach several install-time filesystem joins. With `--trust-lockfile` or a frozen lockfile, traversal segments could create links outside the intended project or `node_modules` boundary. This patch validates dependency name