fix: key allowScripts for R by its resolved name, not the alias

CHANGELOG.md

@@ -4,6 +4,14 @@
 
 ### Fixed
 
+- **`allowScripts` now names R by the identity npm actually matches on.** The
+  entry was `tree-sitter-r@1.3.0`, the alias in `dependencies`, but npm derives
+  the identity from the resolved package in the lockfile —
+  `@davisvaughan/tree-sitter-r@1.3.0`. The old key matched nothing, so the
+  grammar's install script counted as unreviewed and was blocked;
+  `npm ci --strict-allow-scripts` failed on it. Harmless in practice only
+  because the package ships prebuilds for every supported platform. Note the
+  `overrides` key must stay the alias — the two fields key differently.
 - **`graft check` no longer reports every container-tier node as `removed`.**
   `checkGraph` branched on the depth and breadth tiers but never on the container
   tier the build uses for `.vue`, so `genericLangOf` returned null, a `generic!`

node_modules

@@ -0,0 +1 @@
+/Users/shrishdwivedi/Documents/Context graphs/context-graph-engine/node_modules

package.json

@@ -93,6 +93,6 @@
     "fsevents@2.3.3": true,
     "tree-sitter-kotlin@0.3.8": true,
     "tree-sitter-php@0.23.12": true,
-    "tree-sitter-r@1.3.0": true
+    "@davisvaughan/tree-sitter-r@1.3.0": true
   }
 }