…otstrap

Port pnpm's eager shard pre-creation plus its lazy per-directory
cache into pacquet's CAFS write path so per-file `write_cas_file`
calls don't pay `create_dir_all` (and its backing `stat`) on every
entry of every tarball.

- `StoreDir::init` eagerly mkdirs `v11/files/` and all 256 shards
  (`00`..`ff`) on a fresh store, gated by an `exists()` check on
  `files/` so a warm store pays only one stat. Matches the pattern
  pnpm introduced upstream in
  pnpm/pnpm@298e5dc (PR #8700).
- `DashSet<u8>` on `StoreDir` caches which shards this process has
  already ensured. `StoreDir::init` seeds it with all 256 entries;
  `write_cas_file` consults it on every write and only falls back
  to `ensure_parent_dir` on a miss. Belt-and-suspenders matches
  pnpm's `store/cafs/src/writeFile.ts` `dirs` Set.
- `ensure_file` is split into `ensure_parent_dir` (create dir
  tree, idempotent) plus `ensure_file` (open + write; parent must
  already exist). Only `write_cas_file` calls the former, and only
  when the shard isn't cached yet.
- Wired into `install_without_lockfile::run` and
  `create_virtual_store::run` via `spawn_blocking`. Init failure
  degrades to a `warn!`; the lazy per-shard mkdir fallback inside
  `write_cas_file` still handles missed shards.

No behavior change: CAFS layout, error semantics, and file-write
ordering are unchanged. On a cold install of ~10k files this
avoids ~9700 redundant `stat` syscalls. Tests cover fresh-store
shard creation, warm-store cache seeding (sentinel survives init),
and cas_file cache population.

…init io errors

Copilot flagged two shapes on #276:

- `StoreDir::init` used to seed the cache with all 256 shards even on
  the warm-store branch where it skipped the mkdirs. If a shard dir
  was missing (e.g. store created by an older pacquet that only
  materialized shards lazily), `write_cas_file` would trust the
  cache, skip `ensure_parent_dir`, and then `ensure_file` would blow
  up at `open` with `NotFound`. Warm-store `init` is now a near-noop
  that returns after the `files/` existence check without seeding —
  the lazy fallback inside `write_cas_file` populates the cache per
  shard on first write, matching pnpm's `writeFile.ts` `dirs` Set
  shape. Updated the `init_warm_store_*` test to pin the new
  invariant (cache stays empty on warm store).

- Both bootstrap sites were only warning on `JoinError` from
  `spawn_blocking(move || store_dir.init()).await`; an `io::Error`
  returned by `init` itself arrived as `Ok(Err(_))` and was silently
  dropped. Switched both to a full `match` that warns on both error
  layers, so permission-denied / disk-full failures are still
  diagnosable.

No behavior change on the happy path; fresh-store init still creates
all 256 shards and seeds the cache. Tests: 191/191 pass, 0 warnings.

Two more shapes from the Copilot review on #276:

- `StoreDir::init` gated on `files.exists()`, which returns `true`
  for any path type. If `v11/files` was a regular file or broken
  symlink (store corruption, half-written bootstrap), init would
  silently noop and every later `write_cas_file` would fail with a
  cryptic per-file `open` error. Gate on `is_dir()` instead — the
  happy path is unchanged, and the corrupt case falls through to
  `create_dir_all` which surfaces a clear "not a directory" error
  from the kernel that the caller already degrades to `warn!`.
  Added `init_rejects_non_directory_files_path`.

- `shard_cache_populates_on_first_write_and_skips_mkdir_thereafter`
  had a doc comment claiming the test removes the parent directory
  between writes — it never does. Rewrote the comment to describe
  what the test actually pins (lazy cache population, warm-cache
  `exists()` noop, follow-up write in the same or a new shard) and
  moved the "recovering from out-of-band rmdir is out of scope"
  caveat up front so it doesn't contradict the preceding paragraph.

No behavior change on the happy path. Tests: 192/192 pass, 0
warnings.

Two more from Copilot on #276:

- The per-shard `AlreadyExists` branch in `StoreDir::init` used to
  mark the shard as ensured unconditionally. A regular file or
  non-dir symlink squatting on `v11/files/XX` (parallel process
  corruption, tampered store) would be accepted silently, and
  `write_cas_file` would later trust the cache, skip
  `ensure_parent_dir`, and fail at `open` with a cryptic error.
  After catching `AlreadyExists`, verify `shard_dir.is_dir()` — if
  not, return `io::Error { kind: AlreadyExists, ... }` naming the
  offending path. Mirrors the top-level `is_dir()` gate on `files/`
  and keeps failure diagnosable at install bootstrap.

- The `init` rustdoc still said "gated by an `exists()` check";
  previous round switched to `is_dir()` but the doc wasn't updated.
  Fixed, with a note explaining why `is_dir()` is tighter (non-dir
  corruption at `files/` no longer silently noops). Also updated the
  "benign `AlreadyExists`" paragraph to mention the new non-dir
  rejection.

No happy-path change. Tests: 192/192 pass, 0 warnings. The per-
shard guard is defense-in-depth for a narrow race (regular file
planted at `files/XX` between `create_dir_all(files)` and the
loop's `create_dir(shard)`) that's hard to reproduce reliably in a
unit test; the top-level `init_rejects_non_directory_files_path`
test exercises the same "non-dir at a shard-path position" failure
mode via `files/` itself.

…to-dir

Copilot flagged that `StoreDir::init`'s doc said "regular file or
symlink squatting" while the implementation uses `Path::is_dir`,
which follows symlinks and accepts a symlink pointing at a real
directory. Tighten the wording on both the rustdoc and the inline
comment to name exactly what's rejected — regular file, non-dir
symlink, broken symlink — and explain why following symlinks is
desired (ops folks occasionally spread a store across disks via
symlinked shards). No behavior change.

CI's Doc step failed on the previous commit with:
  error: unresolved link to `Path::is_dir`
  error: could not document `pacquet-store-dir`

`std::path::Path` isn't in scope at the rustdoc site, so
[`Path::is_dir`] couldn't resolve. Use the same reference-style
pattern already in use elsewhere in the file for
`AlreadyExists` / `std::io::ErrorKind::AlreadyExists`. Verified
locally with `RUSTDOCFLAGS='-D warnings' cargo doc --no-deps --workspace`.

…helper

Two Copilot comments on #276 pointed out the shard-init bootstrap
block was duplicated verbatim in `install_without_lockfile.rs` and
`create_virtual_store.rs`, and that an earlier round had them drift
(different warning wording), which would make grepping the install
log frustrating.

Move the `spawn_blocking` + nested-Result degradation into a new
`crates/package-manager/src/store_init.rs` module exposing
`init_store_dir_best_effort(&'static StoreDir) -> impl Future`.
Both call sites now delegate to it, so log text and error policy
stay in sync.

Also drops a `dbg!(err)` from `init_rejects_non_directory_files_path`
that would have printed noisy output on every test run (third
Copilot comment). `expect_err` already asserts the failure; the
error-kind check isn't portable enough to pin, and the helper
already surfaces it via `warn!` at runtime.