The frontend test stack (added in this PR for SVG sanitization
coverage) pulls vitest, which transitively depends on esbuild.
esbuild's postinstall downloads the platform-specific native
binary (esbuild-linux-x64, etc.); it has no runtime exposure for
Studio and is a top-tier maintained package.
Add a file-based allowlist mechanism to
scripts/check_new_install_scripts.py so well-known, eyeballed
install-script deps can be triaged without weakening the gate
for the long tail. Defaults to
studio/frontend/.install-script-allowlist; the new file lists
esbuild with a comment explaining the safety review. The gate
otherwise behaves as before -- any other newly-added
install-script dep still hard-fails.
fb6a6703cb