Explain Windows pnpm failures, refuse unreadable package manager scripts, and polish the CLI

[fstubner]

What changes for someone using nvx

• nvx allow-host --remove <host[:port]> takes a host back out of allow_hosts, in the file the command adds to. A trusted project file stays trusted, because taking a host out only narrows it. A file nobody had trusted is not trusted by it.
• nvx --strict tsc says that tsc is a program in the project's node_modules/.bin and prints the working form, nvx --strict shim tsc. It still exits 2 and does not run the program, because running whatever node_modules/.bin holds for a mistyped nvx command would let a cloned project answer it with its own code.
• bunx and a project's own programs no longer end with [UNDICI-EHPA] Warning. They run on the Node.js that nvx put first on the contained PATH. nvx reads its version from the folder name, so a Node.js that refuses the flag still does not get it.
• A blocked host no longer ends with a second refusal that offers NVX_YES. The run ends with one line saying it was stopped because nvx refused a connection. The sandbox-did-not-start half of that second refusal was already fixed in Fix Windows stdin-only pipe hang, launch attribute lifetime, and lost scaffolds #188.
• The line after a refused host stops blaming the host. nvx cannot read the command's output, so it says what happened, keeps exit 77, and adds that allowing the host helps only if the command's own error is about that connection.
• nvx doctor no longer fails yarn or pnpm for being corepack's launcher. A launcher downloads the package manager the first time it runs, and doctor starts it with no network.
• A pnpm or yarn kept outside nvx's folders is refused with the fix when it starts through node. It stopped with Cannot find module, exit 1. It is now refused with exit 77, naming the folder to put in allow_read_exec. That folder in allow_read_exec runs it contained.
• A contained pnpm run that exits 1 or 127 ends with a note naming the two pnpm failures that mention no sandbox, and Known limitations lists them. The 127 panic (Failed to get source volume info) is not a workspace problem. It comes from any install that includes a package with install scripts, with pnpm 9.15.9, 10.34.6 and 11.28.5. No pnpm option avoids it, so it is documented with the ways round.
• nvx grants reset --all exits 0 when a granted folder was deleted, and withdraws the permission where a renamed folder went. A record now keeps the folder's file ID beside its path. The old exit 1 existed because a path with nothing at it cannot say whether the folder was deleted or renamed. A record from before this change gets an ID on the next contained run, and behaves as it did until then.
• Known limitations explains why curl.exe fails TLS with CRYPT_E_REVOCATION_OFFLINE and names --ssl-no-revoke. Allowing the certificate authority's host cannot help, because Windows makes that request itself and it never reaches nvx's proxy.

How it was checked

• gofmt -l internal cmd prints nothing, and go vet ./... passes for windows, linux and darwin.
• go test ./internal/nvx -count=1 passes on Windows, and so does the same run with NVX_PROBE=1, which launches real AppContainers.
• The tests that do not need Windows pass in a Linux container (golang:1.26). In the container's full run, TestContainedProcessCannotTypeIntoTheTerminal fails, and it fails the same way on main, because the image has no ip.
• Each behaviour test fails on main: 13 tests, 3 of them probes that launch a real AppContainer. The tests of the new helper functions do not compile there. Real before and after runs in a scratch NVX_HOME are the measurements in the changelog entries.
• site: npm run build ends with pagefind's known local Access is denied panic, npm run check:content and the changelog date check pass.