fix(deps): build isolated-vm on install via root trustedDependencies (#5935)

.npmrc set ignore-scripts=true globally, which overrode Bun's
trustedDependencies allowlist and blocked every lifecycle script —
including the repo's own root scripts. isolated-vm therefore shipped
unbuilt and each contributor had to npm rebuild it by hand.

The .npmrc line landed in the May 2025 Bun migration, seven months before
isolated-vm was introduced. Two later commits added isolated-vm to
trustedDependencies (root, then apps/sim) and both were silently inert.

- delete .npmrc; lifecycle policy now lives solely in root trustedDependencies
- add isolated-vm to root trustedDependencies
- drop the workspace-level trustedDependencies from apps/sim (Bun only reads
  the root list, so it never had any effect)
- drop the .npmrc entry from CODEOWNERS

Naming any package in trustedDependencies replaces Bun's curated
default-trust list, so only isolated-vm and sharp may run install scripts.
Docker is unaffected — all three Dockerfiles pass --ignore-scripts
explicitly and rebuild isolated-vm against the Node ABI by hand.

Author: waleedlatif1

.github/CODEOWNERS

@@ -37,4 +37,3 @@ package.json @simstudioai/deps
 bun.lock @simstudioai/deps
 **/bun.lock @simstudioai/deps
 bunfig.toml @simstudioai/deps
-.npmrc @simstudioai/deps

.npmrc

@@ -257,13 +257,6 @@
     "vite-tsconfig-paths": "^5.1.4",
     "vitest": "^4.1.0"
   },
-  "trustedDependencies": [
-    "canvas",
-    "better-sqlite3",
-    "ffmpeg-static",
-    "isolated-vm",
-    "sharp"
-  ],
   "overrides": {
     "next": "16.2.11",
     "@next/env": "16.2.11",

apps/sim/package.json

@@ -89,6 +89,7 @@
     ]
   },
   "trustedDependencies": [
+    "isolated-vm",
     "sharp"
   ],
   "dependencies": {