Greptile Summary

This PR adds end-to-end support for Yarn Berry's patch: protocol: the parser extracts local patch paths from lockfile resolution entries into LockfileGraph.patched_dependencies, the writer preserves the original manifest spec (including ::version=…&hash=…) via a patch_specs side-map, and load_patches_for_linker merges lockfile-declared patches into the materializer.

• Parse: patch_protocol_path extracts the project-relative path from the #-fragment; built-in patches (~builtin<…>) return None and are skipped. Both the is_safe_patch_rel path guard and split_patch_key validation apply to lockfile-sourced paths.
• Write: patch_spec_matches checks whether a manifest spec's path matches the stored lockfile path; when it matches, berry_exact_spec returns the full manifest spec so the header round-trips without duplication.
• Install: All three load_patches_for_linker call sites now pass graph.patched_dependencies; the static cache key widens to (PathBuf, BTreeMap<String,String>) so different patch sets remain independent.

Confidence Score: 5/5

Safe to merge; the new patch-loading path goes through the same safety guards as the existing pnpm/bun patch code, and both issues raised in prior rounds are addressed

Built-in patch detection and path-traversal guards are correctly wired end-to-end. The patch_specs mechanism reliably preserves the full manifest spec for the typical Yarn-generated case where both the lockfile and package.json use the same path format. The remaining ./-normalization edge case degrades to the old behaviour rather than causing a hard failure or data loss

No files require special attention; both observations are in the round-trip writer path and do not affect patch application at install time

Important Files Changed

_{Reviews (3): Last reviewed commit: "fix(yarn): handle berry patch edge cases" | Re-trigger Greptile}