// Phase 1 allowScripts gate: a `false` verdict from the policy matcher
    // means the user explicitly denied install scripts for this node, so skip
    // it. `true` and `null` (unreviewed) both fall through to the existing
    // detection logic — unreviewed nodes still run their scripts in Phase 1
    // and are surfaced via the post-reify advisory warning. The global
    // --ignore-scripts kill switch in #build() still takes precedence, and
    // --dangerously-allow-all-scripts bypasses this gate entirely.
    if (!this.options.dangerouslyAllowAllScripts &&
        isScriptAllowed(node, this.options.allowScripts) === false) {
      return
    }