Runner CLI installer: refuse an unpinned name

Found in task 7292's security review. `runner_cli_pins.py install` sends any name that has no `[[npm]]` pin to a plain `npm install -g`, with no version and no digest. `runner_cli_pins.py spec` also exits 0 for an unpinned name. So if the pin for a vendor CLI is deleted or misspelled, `packaging/postinst` and `packaging/jaah-runner-clis-vn` install that CLI's latest release, unverified. The only exception is the OMX refresh, whose `refresh_argv` raises. Only the language-server arms are meant to be unpinned: `typescript-language-server typescript@5`, `basedpyright`, and `@ast-grep/cli@<ver>`. Ask: make the "must be pinned" rule explicit. `install` refuses an unpinned name unless the caller passes an explicit marker, for example `--unpinned`, before it. Only the language-server arms in postinst pass that marker. The vnode floor's `npm_arm` relies on `install` refusing, and no longer on `spec`. Out of scope: pinning the language servers. Changing any pinned version. Done means: - A provider arm whose package has no `[[npm]]` entry makes the install refuse (exit 2), and nothing is installed. A test proves this for both postinst and the vnode floor. - The language-server arms still install.

runner_cli_pins.py `install` (was `spec`) refuses an unpinned name with exit 2 unless it is marked `--unpinned`. Only postinst's language-server arms pass the marker. Tests cover postinst and the vnode floor. Quick gate and changed-area tests green; PR #5954 queued in the merge lane.