fix: correct bundled sigstore from dev dependency conflict (#9740)

This PR fixes #9722.

`mock-registry` pinned `@npmcli/arborist@^9.1.2`, which meant the local
workspace version wasn't linked and the dependency was pulled from the
registry instead. `sigstore@^4` got installed at the root node_modules
and `^5` was put into `workspaces/libnpmpublish/node_modules`. The
dev-only `^4` was then excluded when npm was packed.

Fix:
- `mock-registry`: arborist `^9.1.2` ->  `^10.0.0`
- `workspaces/arborist`: validate-npm-package-name `^7.0.2` -> `^8.0.0`
(need to release a patch for arborist)
- Lockfile regenerated via install + dedupe; `node . run dependencies`


The packed tarball now contains `package/node_modules/sigstore` and
`publish --dry-run` from the extracted tarball succeeds.