Testing npm Provenance and ignore-scripts Against a Real Install-Time RAT Payload

A hands-on test of whether npm provenance attestations and --ignore-scripts actually block an install-time RAT payload, using the Overlord RAT npm packages that racked up 40,767 downloads as the reference case.