fix(ci): allow omitted bundled dependencies in lockfile validation

[arhxam]

What / Why

npm ci can reject a lockfile that npm install just generated when a dependency tarball contains bundled packages that are not independently recorded in the lockfile.

The ideal tree exposes those extracted nodes with inBundle: true, but validateLockfile currently treats every ideal-tree node without a virtual-tree entry as missing. This reports EUSAGE even though the parent tarball supplies the node and a clean install can proceed without resolving it from the registry.

Change

• Ignore absent ideal-tree entries only when Arborist marks them inBundle.
• Keep reporting ordinary missing dependencies.
• Add focused regression coverage for both cases in the same validation pass.

Testing

• node . run test -- test/lib/utils/validate-lockfile.js --no-coverage
• node . run test
• Reproduced the issue's @aws-amplify/data-construct@1.17.7 sequence locally: two npm install runs followed by npm ci. The unpatched CLI reports four missing @opentelemetry/core@2.0.0 entries; this branch completes npm ci and installs 219 packages.

References

Fixes #9821

AI assistance

This change was developed with AI assistance. I reproduced the issue against the current latest branch, reviewed the implementation and diff, and ran the checks above locally.