build: configure npm allowScripts and defer puppeteer browser install

[joehan]

Description

In npm v11.16+ (bundled with Node 26 via npm 11.19+), npm introduced the allowScripts security model to track and restrict dependency lifecycle scripts (preinstall, install, postinstall). When installing dependencies in firebase-tools, npm currently warns:

npm warn allow-scripts 4 packages have install scripts not yet covered by allowScripts

The 4 packages are:

• esbuild: Postinstall binary validation/fallback (needed by Vite for bundling MCP webview apps).
• re2: Optional native C++ regex compilation for superstatic.
• protobufjs: Cosmetic versionScheme check; performs no compilation or generation, safe to deny.
• puppeteer: Downloads a ~200MB Chromium browser on install, but is only used for Cloud Storage emulator conformance tests.

This change:

1. Adds allowScripts to package.json approving esbuild and re2, and denying protobufjs and puppeteer. This silences the warning and prepares for npm v12 strict enforcement.
2. Updates scripts/storage-emulator-integration/run.sh to install the Puppeteer browser just-in-time if PUPPETEER_EXECUTABLE_PATH is not set. If already cached, this check completes in ~0.2s; if missing, it downloads Chromium on-demand so storage emulator conformance tests on CI continue to pass without burdening repository-wide installs.

Scenarios Tested

• Verified npm run build succeeds (Vite compiles MCP apps using esbuild).
• Verified scripts/storage-emulator-integration/run.sh browser install logic when cached vs uncached.
• Verified Prettier formatting (package.json and scripts/storage-emulator-integration/run.sh).
• Verified lockfile synchronization (npm-shrinkwrap.json remains unchanged with npm@11.9).
• Verified test suite passes (npm run mocha:fast).

Sample Commands

N/A

[gemini-code-assist]

Code Review

This pull request updates package.json to include allowScripts configuration and modifies scripts/storage-emulator-integration/run.sh to ensure the Puppeteer browser is installed before running conformance tests. The reviewer suggests adding a file existence check for the Puppeteer installation script to provide more robust error handling and clearer feedback if the installation fails.