Add lifecycle script execution (preinstall, install, postinstall) to
both frozen-lockfile and non-frozen install paths.

The executor crate gains a `run_postinstall_hooks` function that reads
a package's `package.json`, runs preinstall/install/postinstall in
order, detects `binding.gyp` for implicit install scripts, and sets
the correct environment (PATH with `.bin` dirs, INIT_CWD,
PNPM_SCRIPT_SRC_DIR). Ports pnpm's `runPostinstallHooks` from
https://github.com/pnpm/pnpm/blob/7e91e4b35f/exec/lifecycle/src/index.ts

The package-manager crate gains two build strategies:
- `BuildModules`: uses lockfile `requires_build` metadata (frozen path)
- `BuildModulesByScanning`: walks the virtual store checking each
  package.json for scripts (non-frozen path, warns on failures since
  bin linking is not yet available)

The `run_install_scripts` test is promoted from known_failures to a
real passing test. The remaining 10 lifecycle tests stay as
known_failures because they depend on bin linking (pnpm#330).

Covers: pnpm/pacquet#299 (Stage 1, "Support building dependencies")

pnpm never scans the filesystem to find packages with lifecycle
scripts. It always uses the dep graph (from lockfile or resolution).
The BuildModulesByScanning approach was an invention that diverged
from upstream behavior: it swallowed errors and ran scripts in an
unpredictable order.

Lifecycle scripts now only run in the frozen-lockfile path where
lockfile metadata (requires_build) is available. The non-frozen
install path does not run lifecycle scripts until it gains a dep
graph (lockfile writing or resolution graph).

All 11 integration tests are now known_failures. They will be
promoted once the non-frozen path writes lockfiles or once
pre-generated lockfile fixtures are added.

- Warn when package.json exists but fails to parse (instead of
  silently defaulting to deny-all)
- Return OsString from build_path_env to avoid panic on non-UTF-8 PATH
- Fix run_postinstall_hooks return value to reflect actual execution
  (not just script presence)
- Bind frozen-reinstall CommandTempCwd to a variable so the mock
  registry stays alive through the command execution

Port pnpm's `buildSequence` and `graphSequencer` so packages with
`requires_build` run children-first. Previously `BuildModules` iterated
snapshots in HashMap order, so a postinstall that shells out to a
sibling-dep CLI could run before that dep had built — failing
non-deterministically.

`build_sequence` walks the dep graph from each importer's direct
dependencies, keeps only nodes whose subtree contains a build node, and
hands the subgraph to `graph_sequencer` to produce topologically ordered
chunks. `BuildModules` now iterates chunks in order; within a chunk
members remain independent (concurrency is still a TODO).

References:
- building/during-install/src/buildSequence.ts
- deps/graph-sequencer/src/index.ts
in https://github.com/pnpm/pnpm/blob/80037699fb/

Pre-existing alignment drift introduced in a1dc3fd. `just ready` only
runs `cargo fmt`, not `taplo format`, so it was missed locally; CI's
`taplo format --check` caught it.

`InstallFrozenLockfile` was reading both `AllowBuildPolicy` and
`BuildModules.lockfile_dir` from `std::env::current_dir().unwrap_or_default()`,
which is wrong when the process CWD differs from the project root and
silently masks CWD failures via the empty-path fallback. Pass the existing
`requester` (derived from `manifest.path().parent()`) instead.

Resolves the install_frozen_lockfile.rs:89 review comment on PR pnpm#391.

The CODE_STYLE_GUIDE.md "When or when not to log during tests" rule
requires logging context before bare `assert!(...)` calls so failures
print more than just the expression text. Add `dbg!` of the inspected
value and assertion messages with `{value:?}` so a future regression
shows the full structure instead of "assertion failed".

Match upstream's NDJSON wire format for the build phase so
@pnpm/cli.default-reporter parses pacquet's lifecycle output the same
way it parses pnpm's.

- Add `LogEvent::Lifecycle(LifecycleLog)` with the three upstream
  message shapes (Script, Stdio, Exit) as a `#[serde(untagged)]`
  union, mirroring `core/core-loggers/src/lifecycleLogger.ts`.
- Add `LogEvent::IgnoredScripts(IgnoredScriptsLog)` carrying
  `packageNames` (camelCase), mirroring `ignoredScriptsLogger.ts`.
- `pacquet-executor` depends on `pacquet-reporter`. `run_postinstall_hooks`
  / `run_lifecycle_hook` are now generic over `R: Reporter`. The hook
  switches from `Stdio::inherit()` to `Stdio::piped()` and reads each
  stream on its own thread, emitting one `Stdio` event per line. A
  `Script` event fires before spawn, `Exit` fires after wait — same
  ordering as `runLifecycleHook.ts:102/165`.
- `BuildModules::run::<R>` collects sorted (peer-stripped) keys of
  packages that hit the "not in allowBuilds" branch and returns them
  as `Vec<String>`. Explicit `false` is silently skipped, matching
  upstream's switch in `building/during-install/src/index.ts:88-101`.
- `InstallFrozenLockfile::run` emits one `pnpm:ignored-scripts` event
  with the returned list (always, even when empty) — mirrors the
  unconditional emit at `installing/deps-installer/src/install/index.ts:414`.

Tests:
- Wire-shape tests for both new variants pin the JSON output.
- Recording-fake tests for `run_postinstall_hooks` cover Script→Stdio→Exit
  ordering and non-zero exit propagation.
- Recording-fake tests for `BuildModules::run` cover the ignored-builds
  return value (sorted, peer-stripped, excludes explicit-deny).
- Updated `install_emits_pnpm_event_sequence` to expect the new
  `IgnoredScripts` event between `Stats` and `ImportingDone`.

Addresses items pnpm#6 and pnpm#8 from pnpm#397.

Upstream refs at `pnpm/pnpm@80037699fb`:
- core/core-loggers/src/lifecycleLogger.ts
- core/core-loggers/src/ignoredScriptsLogger.ts
- exec/lifecycle/src/runLifecycleHook.ts
- building/during-install/src/index.ts
- installing/deps-installer/src/install/index.ts

Per CODE_STYLE_GUIDE.md: log before non-assert_eq! assertions so CI
failures are easier to diagnose.

…pm on all stages

Two fixes from the lifecycle gap audit (pnpm#397):

- Malformed package.json now returns Ok(false) instead of a hard
  error, matching upstream safeReadPackageJsonFromDir which returns
  null on missing OR malformed manifests.

- The "npx only-allow pnpm" skip now applies to preinstall and
  postinstall too, not just install. Upstream skips it for every
  stage at runLifecycleHook.ts:100.

…on_from_dir

Mirror upstream's split between manifest reading and lifecycle dispatch:

- Add safe_read_package_json_from_dir to pacquet-package-manifest, matching
  safeReadPackageJsonFromDir at
  https://github.com/pnpm/pnpm/blob/80037699fb/pkg-manifest/reader/src/index.ts#L48
  (returns Ok(None) only on ENOENT; other IO errors and JSON parse errors
  propagate).
- run_postinstall_hooks now calls the helper instead of inlining the IO
  and parse, matching upstream runPostinstallHooks at
  https://github.com/pnpm/pnpm/blob/80037699fb/exec/lifecycle/src/index.ts#L22
- LifecycleScriptError::ReadManifest wraps PackageManifestError to cover
  both IO and parse failures.

Reverts the malformed-JSON Ok(false) from 18c624c. The audit (pnpm#397 item 7)
claimed safeReadPackageJsonFromDir returns null on malformed JSON, but the
upstream try/catch only swallows ENOENT — BAD_PACKAGE_JSON re-throws.

New tests cover the missing-manifest Ok(false) path and the malformed-
manifest LifecycleScriptError::ReadManifest path with
PackageManifestError::Serialization as the source.

… pure new + IO wrapper

Match upstream's separation between policy logic and config sourcing:

- Add AllowBuildPolicy::new(rules, dangerously_allow_all) — pure
  constructor mirroring createAllowBuildFunction(opts) at
  https://github.com/pnpm/pnpm/blob/80037699fb/building/policy/src/index.ts
- from_manifest is now a thin wrapper that reads package.json, extracts
  the pnpm section, and delegates to new.

The 7 policy-logic tests now drive new(...) directly with in-memory rule
maps, matching upstream's tests at
https://github.com/pnpm/pnpm/blob/80037699fb/building/policy/test/index.ts
that drive createAllowBuildFunction(opts) decoupled from Config parsing.
The from_manifest path keeps a missing-manifest test plus a new
from_manifest_parses_pnpm_section integration test for the wrapper.

…kfile field

Match upstream's source-of-truth for whether a package needs a build pass:
the extracted package's own files, not the lockfile. Real pnpm-generated
v9 lockfiles rarely include requiresBuild for individual packages —
upstream computes it on the fly via pkgRequiresBuild after extraction
(https://github.com/pnpm/pnpm/blob/80037699fb/worker/src/start.ts#L147),
attaches it to the in-memory dep node, and gates the build pipeline on
that. Pacquet was reading the optional lockfile field directly, so
installs against any lockfile without requiresBuild silently skipped
every script — including for fsevents, esbuild, native deps, etc.

Changes:

- Drop requires_build: Option<bool> from PackageMetadata in pacquet-lockfile.
  Existing lockfiles with requiresBuild lines deserialize fine — serde
  ignores unknown fields by default.
- BuildModules::run computes a requires_build_map by walking each snapshot's
  pkg_dir under the virtual store and calling pkg_requires_build (added in
  the previous commit). The map is used both for the per-package gate and as
  input to build_sequence.
- build_sequence now takes a &HashMap<PackageKey, bool> instead of
  &HashMap<PackageKey, PackageMetadata>; the metadata field it consulted
  no longer exists, and the map is the right shape for what it actually
  needs.
- BuildModules drops the now-unused packages field.
- Tests in build_modules and build_sequence updated to drive the new shape:
  build_sequence tests pass an in-memory map directly; build_modules tests
  materialize a real package.json fixture under the virtual store path so
  pkg_requires_build returns true.

Move the importing_done emit out of the install.rs orchestrator and into
the install paths, fired right after extraction and symlink linking
finish. Mirrors upstream link.ts:167-170, where the stage marker closes
the import progress display before any build phase begins:
https://github.com/pnpm/pnpm/blob/80037699fb/installing/deps-installer/src/install/link.ts#L167

Previously install.rs emitted importing_done after the entire frozen
install path returned — including BuildModules — so reporters would keep
the import progress bar open while lifecycle scripts ran, and lifecycle
output rendered before importing was marked done.

InstallFrozenLockfile now emits importing_done between
SymlinkDirectDependencies and BuildModules. InstallWithoutLockfile emits
it after the writer task drains (its end-of-import boundary; this path
does not run scripts today). install.rs no longer emits importing_done
itself.

Updates install_emits_pnpm_event_sequence to expect the new
importing_done position before pnpm:ignored-scripts.