chore(test): mark 'npx' literal in with-subcommands stubs as allowed

The bucketed-command stub object includes the literal command name
'npx' as a key. Add the canonical inline marker so the pre-commit
security scanner stops flagging it as an actual npx invocation.

Author: jdalton

packages/cli/test/unit/utils/cli/with-subcommands.test.mts

@@ -860,7 +860,7 @@ describe('meow-with-subcommands', () => {
         logout: stub('logout'),
         manifest: stub('manifest'),
         npm: stub('npm'),
-        npx: stub('npx'),
+        npx: stub('npx'), // socket-hook: allow npx
         nuget: stub('nuget'),
         optimize: stub('optimize'),
         organization: stub('organization'),