fix: add node ecosystem to smoke-codex network allow-list

The Smoke Codex workflow asks the agent to run `npm ci && npm run build`
(step 8), but `registry.npmjs.org` was not in the allowed domains list.
All 8 npm requests were blocked by the firewall, causing the agent to
fail before it could call `add_comment` (the required safe output).

Add `node` to `network.allowed` so npm registry traffic is permitted.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Mossaka