fix: exempt explicit pack targets from allow-directory (#9756)

## Summary

- allow explicit directory targets through `npm pack` and `npm publish`
when `allow-directory` is `none` or `root`
- keep dependency fetch policies unchanged and cover the shared library
plus both CLI commands

## Why

`allow-directory` restricts directory dependencies, but the local
package selected for packing or publishing is the command target. The
current flow applies the dependency policy to that target during
manifest or tarball preparation.

Closes #9755.

## Validation

- `node . run test` - passed (123 test files, 100% coverage)
- `node . run test -w libnpmpack` - passed (100% coverage)
- dry-run `pack` and `publish` smokes with `allow-directory=none|root` -
passed

Co-authored-by: ychampion <ychampion@users.noreply.github.com>