…e pins

Mirrors pnpm's #7436 regression guard: a manifest pin like
`"@pkg/has-prerelease": "3.0.0-rc.0"` shouldn't be silently
downgraded to `"2.0.0"` by `aube update --latest` just because the
registry's `latest` dist-tag is older than the user's pin.

Implementation: before building `resolver_manifest`, pre-fetch
packuments for every direct dep that's about to get its spec rewritten
to `latest`, parse the original pin and the registry's
`dist-tags.latest` as semver, and skip the rewrite for any dep where
the parsed pin is numerically newer. The resolver then sees the
original spec, resolves the original version, the lockfile keeps it,
and the manifest rewrite path leaves it alone (because resolved ==
original).

Only applied to bulk `update --latest` (no positional args). When the
user explicitly names a package — `aube update --latest <pkg>` —
they're opting in to whatever `latest` says, even when that downgrades
a prerelease (matches pnpm's `pnpm update <pkg>@latest` behavior).

Packuments come from the same cache the resolver uses moments later,
so the only cost when nothing's stale is a cheap revalidation (5-min
TTL + ETag).

Ports landed:
- pnpm/test/update.ts:615 ('update to latest without downgrading
  already defined prerelease (#7436)') — bulk single-project variant.
  pnpm also runs `update -r --latest` against the same single-project
  fixture; aube's `-r` requires a workspace root, so the recursive
  half is covered by the workspace ports below.
- pnpm/test/update.ts:728 ('update to latest recursive workspace
  (outdated, updated, prerelease, outdated)') — 4-project mix.
- pnpm/test/update.ts:807 ('update to latest recursive workspace
  (prerelease, outdated)') — 2-project mix.

16/22 of pnpm/test/update.ts ported (was 13/22). Drops the
prerelease-preservation divergence from PNPM_TEST_IMPORT.md.

Also notes upstream that `pnpm/test/recursive/update.ts` shrank to a
single `test.skip` upstream — pnpm itself doesn't currently pass the
only test in the file (per-project `packageConfigs.savePrefix` /
`saveExact` doesn't reach `recursive update --latest`). Nothing
portable today; re-evaluate when pnpm un-skips.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…n guard

Two greptile P2 callouts on update.rs:

1. The pre-fetch loop was silently swallowing packument fetch + parse
   errors (`.ok()?`), so a transient registry blip during the
   prerelease-preservation guard would silently fall through to the
   rewrite path and downgrade the user's prerelease pin — exactly the
   bug this guard exists to prevent. Replace the swallow with a
   `tracing::warn!` for both the fetch failure and a non-semver
   `latest` dist-tag, then continue with the resolver path (which has
   its own retry/cache semantics).

2. Document `exact_pin_version`'s slice contract: the returned `&str`
   is the bare version (already stripped of `npm:`, the `<name>@`
   prefix, the optional `=`, and surrounding whitespace), suitable
   for `Version::parse` but NOT a round-trip back to the original
   specifier. Today's only caller hands it straight to `parse`, but
   future callers shouldn't be surprised by the shape.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>