fix!: refuse to pack when overrides apply to bundled packages

[owlstronaut]

Follow up to #9235.

When a package defines overrides that apply to one or more of its bundledDependencies (or bundleDependencies), the resulting bundled tree is invalid from the perspective of any consumer: consumers do not apply the publishing package's overrides when validating the bundled tree, so npm ls will always show invalid edges for the affected bundled packages.

This PR refuses to pack (and therefore publish) such packages with a clear EBUNDLEOVERRIDE error that lists the offending bundled package names. Defining both overrides and bundledDependencies is still allowed — the error only fires when an override actually targets a package inside the bundled subtree. Cases that are now correctly accepted include:

• overrides that target dev dependencies (which are not bundled),
• overrides that target packages outside the bundled subtree, and
• packages that bundle some deps but override only unrelated ones.

The check uses Arborist's own inBundle / inDepBundle / overridden semantics on the actual on-disk tree (the same tree pacote uses to build the tarball), so it stays consistent with what npm-packlist actually publishes.

The check lives in libnpmpack, so it covers npm pack, npm publish, and any direct consumers of the library.

Closes npm/statusboard#1102.

BREAKING CHANGE: npm pack and npm publish now error when a package's overrides apply to one or more of its bundled packages (bundledDependencies / bundleDependencies). Defining both fields is still allowed as long as no override actually targets a bundled package. To resolve the error, remove the affected entries from either overrides or the bundle.

[wraithgar]

What if we have overridden dev dependencies?
What if we only bundle some of our dependencies and none of them are overridden?

[owlstronaut]

What if we have overridden dev dependencies? What if we only bundle some of our dependencies and none of them are overridden?

those are good points. I'll need to make this a little more flexible