fix(owner): use scoped registry for user lookup (#9786)

## Summary

Ensure `npm owner add` and `npm owner rm` resolve users from the same
registry used for the target package.

The user lookup now receives the package `spec`, allowing
`npm-registry-fetch` to honor scoped registry configuration instead of
falling back to the global registry.

## Testing

Added regression coverage for split global/scoped registry
configurations, including:

- Preventing substitution of the user added as an owner.
- Preventing removal of an unintended existing owner.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 1e1231bc-474e-4a27-8b78-242366f48e19