Force autorest cache pre-population onto the private npm feed (CFSClean)

[Gavin Barron (gavinbarron)]

What

Fixes the residual CFSClean network-isolation violation on the PowerShell pipelines (187/221/663): 2 registry.npmjs.org requests per build that remained after the autorest --skip-upgrade-check fix (#3696).

Root cause

Traced from build telemetry + task logs: the 2 hits come from the "Pre-populate autorest extension cache" task. PrePopulateAutorestCache.ps1 runs:

npm install @autorest/core@3.10.4      --prefix <cacheDir>
npm install @autorest/modelerfour@4.24.3 --prefix <cacheDir>

With --prefix, npm did not honor the registry/auth in the authenticated ~/.npmrc (produced by install-tools.yml) and reached registry.npmjs.org directly — each npm install = 1 hit, 2 total. The task meant to prevent autorest's npm calls was itself the leak.

Change (tools/Utilities/PrePopulateAutorestCache.ps1)

Derive --userconfig and --registry from the authenticated ~/.npmrc and pass them explicitly to each npm install, so both installs use the PowerShell_V2_Build private feed (no hard-coded URL). Warn if ~/.npmrc is missing.

Notes

• Complements Stop autorest upgrade-check from egressing to npmjs (CFSClean) #3696 (autorest core upgrade-check) — together these should clear the registry.npmjs.org CFSClean egress for 187/221/663.
• The private feed already serves these packages (verified), so the installs will resolve through it.
• Needs a validation run on main post-merge to confirm zero registry.npmjs.org hits.

Relates to S360 KPI 527fb616-07aa-8198-6419-50d04ef1c2f3 (1ES network isolation).