…-alias catalog (#384)

## Summary

Three bug fixes for
[#383](#383) plus
the supporting refactors that fell out of code review.

### Bug fixes

- **Patches against CRLF text files** — tarballs published from Windows
editors ship CRLF (e.g. `gifuct-js@2.1.2/index.d.ts`), but
git/pnpm-style patches always emit LF. Diffy is byte-exact and refused
to match CRLF context against LF hunks, so a clean patch failed with
`error applying hunk #1`. Normalize the original to LF before apply and
restore CRLF on write — same approach pnpm uses. The CRLF restore also
collapses any `\r\r\n` so a patch line containing a literal `\r` byte
mid-line doesn't gain a second carriage return.

- **`aube patch-commit` destination** — previously wrote unconditionally
to `pnpm.patchedDependencies` in `package.json`, even on projects
already using the pnpm v10+ workspace-yaml home. Now follows the unified
rule below. `aube patch-remove` now strips entries from every place they
could live (both yaml and both `pnpm.*` / `aube.*` namespaces) and
reports the actual files rewritten in its status output.

- **npm-aliased catalog deps from pnpm-generated lockfiles**
([discussioncomment](#383 (comment)))
— `aube install --frozen-lockfile` accepted a pnpm lockfile with
`beamcoder: npm:beamcoder-prebuild@…` (declared via
`pnpm-workspace.yaml#catalog`) and silently produced an empty
`node_modules`. The importer's `specifier:` was `'catalog:'`, but the
alias detection only fired on `specifier.starts_with("npm:")`. Now
detects aliases purely from the `version:` shape (the canonical
`<real>@<resolved>` form pnpm always uses), with a peer-suffix strip so
`version: 18.2.0(react@18.2.0)` doesn't get misclassified.

### Refactor: unified workspace-config writer

One rule applies to every command that mutates a setting which can live
in either the workspace yaml or `package.json#{pnpm,aube}.<key>` (`aube
patch-commit`, `aube patch-remove`, `aube approve-builds`, install-time
auto-deny seeding, future settings):

1. If a workspace yaml exists on disk → write there.
2. Otherwise, if `package.json#pnpm` is already declared → write
`pnpm.<key>` (preserve the user's chosen namespace).
3. Otherwise → write `aube.<key>` (aube's native namespace; the read
side already gives `aube.*` precedence over `pnpm.*`).

New helpers in `aube_manifest::workspace`:
- `ConfigWriteTarget` + `config_write_target(dir)` — picks step 1 vs
steps 2/3.
- `edit_workspace_yaml(path, f)` — yaml writer; **skips the rewrite when
the closure produces no structural change**, so user comments survive
every no-op write. Used by allowBuilds, patchedDependencies, and catalog
cleanup.
- `edit_setting_map(cwd, key, f)` — `package.json` writer; picks
namespace per steps 2/3, also skips no-op rewrites.
- `remove_setting_entry(cwd, key, entry_key)` — strips an entry from
both `pnpm.<key>` and `aube.<key>` so a one-namespace removal doesn't
leave a stale duplicate behind on the read merge.

Migrated callers: `aube approve-builds` (and the install-time auto-deny
seed), `aube patch-commit`, `aube patch-remove`, catalog cleanup. The
`PatchDestination` enum and `edit_patched_dependencies` helper that
lived in `aube/src/patches.rs` are gone.

### Refactor: workspace-yaml file selection

Centralized the `aube-workspace.yaml` → `pnpm-workspace.yaml` precedence
walk into `aube_manifest::workspace::workspace_yaml_existing`.
`workspace_yaml_target` is now a one-liner over it. Removed three
duplicates of the same loop (`catalogs.rs`, `find_workspace_root`,
`find_workspace_yaml_root`).

## Test plan

- [x] `cargo test` (1185 passing — new coverage spans CRLF apply +
embedded-`\r` restore in `aube-linker`; helper-level + per-writer
no-op-skip tests for allowBuilds, patchedDependencies, and catalog
cleanup; `ConfigWriteTarget` + namespace-picking cases; pnpm-lockfile
catalog alias)
- [x] `cargo clippy --all-targets -- -D warnings`
- [x] `cargo fmt --check`
- [x] End-to-end repros from the discussion: `aube install` against
`patch-application-failure` succeeds with CRLF preserved; `aube install
--frozen-lockfile` against `catalog-npm-alias` installs `beamcoder`
(resolved to `beamcoder-prebuild`) into `packages/app/node_modules/`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Touches install/patch/config persistence paths and changes where
settings are written (`workspace` YAML vs `package.json`), which can
affect real projects’ config layout; mitigated by extensive new tests
and largely additive helpers.
> 
> **Overview**
> Fixes patch application on CRLF-backed files by normalizing input to
LF for diff matching and restoring CRLF on write (with protection for
embedded literal `\r`), plus adds regression tests.
> 
> Unifies how workspace-level settings are written: if a workspace yaml
exists, write there; otherwise write to `package.json` under `aube.*`
unless `pnpm` already exists. This refactor is applied to `allowBuilds`
seeding/approval, `patch-commit`/`patch-remove` (including removing
entries from all possible locations and reporting the actual files
changed), and catalog cleanup (now skips no-op YAML rewrites to avoid
stripping comments).
> 
> Fixes pnpm lockfile parsing to detect npm-aliased dependencies based
on the `version:` field shape (including catalog-declared aliases and
peer suffix handling), with new tests.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
74cbd4d. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Skip empty bytes_segment so the phase-2 label doesn't render a
  doubled `·  ·` separator on installs without `dist.unpackedSize`
  (Greptile P1).
* Switch ETA to fetch-window throughput: snapshot completed at the
  set_phase("fetching") boundary, then divide remaining work by
  `fetch_elapsed_ms / (completed - baseline)`. Falls back to `ETA …`
  while the baseline or fetch window are missing. Eliminates the
  pessimistic "110s ETA after a 3s resolve" case (Greptile P2).
* Reconcile estimated_bytes after filter_graph: track per-dep_path
  unpacked_size during streaming, then re-sum surviving dep_paths
  via the new InstallProgress::reconcile_estimated_bytes API.
  Mirrors the package-denominator reconcile applied next to it
  (Greptile P3).
* Apply TARBALL_COMPRESSION_RATIO in TTY refresh_bytes_segment too —
  CI mode applied it; TTY was showing the raw unpacked sum (~3.3×
  inflated) (Cursor #1).
* Refresh ETA on every inc_downloaded_bytes so it doesn't freeze
  during long downloads when no inc_total / inc_reused events fire.
  Documents the trade-off at FetchRow::drop where a refresh would
  require a larger refactor (Cursor #3).
* Style only the ✓ green on the install / no-op summaries instead
  of the whole sentence; aligns with the CI heartbeat summary's
  styling so the success cue stays sharp without bleeding green
  across the line (Cursor #4 + user request).
* Standardize the ✓ prefix on both Already-up-to-date paths
  (`print_install_summary` and `print_already_up_to_date`).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>