Greptile Summary

This PR fixes a round-trip regression where direct HTTPS tarball dependencies in pnpm lockfiles lost their sha512 integrity hash after a parse → write cycle. The fix mirrors the existing git-dep hydration path: both a new RemoteTarball fallback arm (for cases where canonical key lookup misses) and an extension of the matches! guard ensure integrity flows from the packages: resolution block into both LockedPackage.integrity and RemoteTarballSource.integrity.

• read.rs: Adds a LocalSource::RemoteTarball arm to the or_else fallback that matches packages by name + tarball URL, and expands the matches! predicate to also copy integrity for remote tarball sources.
• tests.rs: Adds a regression test with a synthetic pnpm v9 lockfile containing a direct HTTPS tarball dep; asserts both struct fields and the written YAML preserve sha512-*.

Confidence Score: 5/5

Safe to merge — the fix is narrowly scoped to hydrating remote tarball integrity from the packages block, mirrors the already-established git handling, and the new regression test confirms the primary parse→write round-trip works correctly.

Both changes are additive and confined to the lockfile reader: the new RemoteTarball fallback arm follows the same structure as the Git arm it sits next to, and the matches! expansion is a one-operator change with no side effects on other source types. The write path was already correct; only the read side was missing the integrity assignment.

No files require special attention.

Important Files Changed

_{Reviews (2): Last reviewed commit: "fix(lockfile): preserve remote tarball i..." | Re-trigger Greptile}