The minimatch override forces a major above readdir-glob's own range, and archiver's directory() is the only runtime caller of that path. scripts/ check-archiver.cjs archives a small tree and fails if the result is too small to hold it, so the override is guarded by a run rather than by the install succeeding. client/.npmrc is gitignored - it is where a developer's registry credentials live - so the repo-wide ignore-scripts policy is passed on the client install steps instead. Verified locally: npm ci --ignore-scripts, the archiver check and ng build all succeed.