test_runner: add option to forbid exclusive tests

[joao-oliveira-softtor]

With test isolation disabled, an accidentally committed test.only() can
silently exclude the rest of a test suite while the run still succeeds.

Add --test-forbid-only and run({ forbidOnly: true }) to reject exclusive
tests in CI. The guard covers only: true, the test and suite .only()
shorthands, and testContext.runOnly(true), in both isolation modes.
Detected violations fail the run even when a surrounding test is TODO or
expects failure. Only declarations actually evaluated during the run can
be checked.

The option is disabled by default. An explicit forbidOnly: false overrides
an inherited command-line or NODE_OPTIONS setting.

This is a proposed API for the rejection behavior discussed in #60917;
the existing boolean --test-only option is unchanged.

Validation

• Built Node.js v27.0.0-pre locally on Linux x64.
• All 47 new test scenarios passed.
• Ran 87 test files covering the test runner, allowed environment flags,
  CLI options, and configuration files. 86 passed initially; the reporters
  test passed when rerun without the environment's NO_COLOR, which
  conflicted with the test's FORCE_COLOR setting.
• JavaScript, C++, and Markdown lint passed; regenerated and checked the
  manual page.
• Before implementation, both new API regression cases failed because
  the run incorrectly succeeded.

Full repository and cross-platform CI have not been run locally.

AI assistance

Codex assisted with implementation, test authoring, source review, and the
local automated checks described above. This draft is being opened by
the coding agent at the contributor's explicit request. These checks do
not represent personal verification by the contributor.

Refs: #60917

[nodejs-github-bot]

Review requested:

• @nodejs/config
• @nodejs/test_runner

[github-actions]

Caution

AgentScan found account activity patterns that may be consistent with automation. This is a heuristic, not proof that this pull request was opened by an agent or violates policy. AI-assisted contributions are permitted, but automated tooling must not open pull requests without advance approval, and contributors must personally understand, test, verify, and take responsibility for every submitted change. See the AgentScan analysis, AI use policy, and automation policy for additional context.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.46%. Comparing base (cd18965) to head (10f01c4).
⚠️ Report is 32 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #66578      +/-   ##
==========================================
+ Coverage   90.43%   90.46%   +0.03%     
==========================================
  Files         791      791              
  Lines      276488   276596     +108     
  Branches    53097    53129      +32     
==========================================
+ Hits       250029   250212     +183     
+ Misses      16855    16797      -58     
+ Partials     9604     9587      -17     

Files with missing lines	Coverage Δ
lib/internal/test_runner/runner.js	95.18% <100.00%> (+0.05%)	⬆️
lib/internal/test_runner/test.js	97.96% <100.00%> (+0.01%)	⬆️
lib/internal/test_runner/utils.js	66.26% <100.00%> (+0.09%)	⬆️
src/node_options.cc	81.73% <100.00%> (+0.02%)	⬆️
src/node_options.h	95.67% <100.00%> (+0.45%)	⬆️

... and 37 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.