pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle (CVE-2026-55487) | HOL Guard CVE