…ePackage (#436 §B+D)

Builds on §A (#440). Adds a new `pacquet-git-fetcher` crate that
handles `LockfileResolution::Git` snapshots during frozen-lockfile
installs, plus the supporting `preparePackage` port. The install
dispatcher now routes git resolutions through it instead of returning
`UnsupportedResolution { resolution_kind: "git" }`.

New crate `pacquet-git-fetcher`:

- `GitFetcher` shells out to the system `git` (clone, or `init` +
  `fetch --depth 1` on hosts in `git_shallow_hosts`), checks out the
  pinned commit, verifies it via `rev-parse HEAD`, runs
  `preparePackage`, removes `.git`, computes a packlist, and imports
  the resulting file set into the CAS. Surfaces a friendly
  `GitNotFound` when `git` isn't on `PATH` — pacquet does not bundle
  it. Mirrors `fetching/git-fetcher/src/index.ts`.

- `prepare_package` ports `exec/prepare-package/src/index.ts`. Reads
  the manifest, decides via `package_should_be_built`, honors an
  `AllowBuildFn` (the dispatcher adapts pacquet's `AllowBuildPolicy`
  into this shape), runs `<pm>-install` plus any `prepublish` /
  `prepack` / `publish` scripts via the existing
  `pacquet_executor::run_lifecycle_hook`, then deletes `node_modules`.
  Emits the upstream error codes `GIT_DEP_PREPARE_NOT_ALLOWED`,
  `ERR_PNPM_PREPARE_PACKAGE`, and `INVALID_PATH`.

- `detect_preferred_pm` sniffs the cloned tree for a lockfile to pick
  the install pm (`pnpm-lock.yaml` → pnpm, `yarn.lock` → yarn, etc.),
  defaulting to npm. Workspace-root walking is deferred — git-hosted
  snapshots almost always ship a lockfile at the repo root.

- A minimal `packlist` honors the manifest's `files` field with a
  tiny `*` / `**` / `?` glob matcher, always-includes the README /
  LICENSE / package.json set, and always-excludes `.git`,
  `node_modules`, lockfiles for sibling pms, and common cruft.
  Full `.npmignore` / `.gitignore` semantics and
  `bundleDependencies` walking are deferred and tracked in module
  docs; `bundleDependencies` emits a `warn!` so the gap is visible.

Wiring in `pacquet-package-manager`:

- `InstallPackageBySnapshot` now matches `LockfileResolution::Git`
  and runs the fetcher in place of `DownloadTarballToStore`. The
  helper `tarball_url_and_integrity` factors out the per-resolution
  branch so each variant builds its own `cas_paths`.
- Threads `&AllowBuildPolicy` from `InstallFrozenLockfile` → through
  `CreateVirtualStore` → into `InstallPackageBySnapshot`, computing
  the policy once per install instead of per snapshot.
- `snapshot_cache_key` returns `Ok(None)` for `Git` resolutions so
  they go cold-batch in this PR. Warm prefetch for git-hosted slots
  is a follow-up alongside §C.

Supporting changes:

- `GitResolution.path: Option<String>` (§A back-fill) so a lockfile
  pinning a sub-directory of a git-hosted monorepo deserializes
  without tripping `deny_unknown_fields`.
- `Config::git_shallow_hosts` with pnpm's default list
  (`github.com` / `gist.github.com` / `gitlab.com` / `bitbucket.com` /
  `bitbucket.org`) and `pnpm-workspace.yaml` override support.
- `pacquet_executor::run_lifecycle_hook` is now `pub` so the
  preparePackage port can dispatch by arbitrary stage name without
  going through `run_postinstall_hooks`'s pre/install/post triple.

Out of scope (follow-ups for #436):

- §C — git-hosted *tarball* fetcher (the `gitHosted: true` shape).
- §E — full integration-test matrix (`plans/TEST_PORTING.md`
  563-572). This PR ships the seven crate-level tests against a
  local bare repo that prove the path works end-to-end.
- Warm prefetch for git resolutions. The fetcher writes nothing to
  `index.db` today, so a second install re-clones — slow but
  correct.
- Full `npm-packlist` semantics (`.npmignore`, gitignore layering,
  `bundleDependencies` walking).

…ePackage (#436 §B+D) (#446)

Builds on §A (#440). Adds a new `pacquet-git-fetcher` crate that handles `LockfileResolution::Git` snapshots during frozen-lockfile installs, plus the supporting `preparePackage` port. The install dispatcher now routes git resolutions through it instead of returning `UnsupportedResolution { resolution_kind: "git" }`.

### New crate `pacquet-git-fetcher`

- **`GitFetcher`** shells out to the system `git` (clone, or `init` + `fetch --depth 1` on hosts in `git_shallow_hosts`), checks out the pinned commit, verifies via `rev-parse HEAD`, runs `preparePackage`, removes `.git`, computes a packlist, and imports the resulting file set into the CAS. Surfaces a friendly `GitNotFound` when `git` isn't on `PATH` — pacquet does not bundle it. Mirrors [`fetching/git-fetcher/src/index.ts`](https://github.com/pnpm/pnpm/blob/94240bc046/fetching/git-fetcher/src/index.ts).
- **`prepare_package`** ports [`exec/prepare-package/src/index.ts`](https://github.com/pnpm/pnpm/blob/94240bc046/exec/prepare-package/src/index.ts). Reads the manifest, decides via `package_should_be_built`, honors an `AllowBuildFn` (the dispatcher adapts pacquet's `AllowBuildPolicy` into this shape), runs `<pm>-install` plus any `prepublish` / `prepack` / `publish` scripts via the existing `pacquet_executor::run_lifecycle_hook`, then deletes `node_modules`. Emits the upstream error codes `GIT_DEP_PREPARE_NOT_ALLOWED`, `ERR_PNPM_PREPARE_PACKAGE`, `INVALID_PATH`.
- **`detect_preferred_pm`** sniffs the cloned tree for a lockfile to pick the install pm. Workspace-root walking deferred.
- **Minimal `packlist`** honors the manifest's `files` field with a tiny `*` / `**` / `?` glob matcher (`?` and single `*` reject `/`; `**` matches across directories), always-includes the README / LICENSE / package.json set, and always-excludes `.git`, `node_modules`, lockfiles for sibling pms, and common cruft. Full `.npmignore` / `.gitignore` semantics and `bundleDependencies` walking are deferred and tracked in module docs.

### Wiring in `pacquet-package-manager`

- `InstallPackageBySnapshot` now matches `LockfileResolution::Git` and runs the fetcher in place of `DownloadTarballToStore`.
- `&AllowBuildPolicy` is computed once per install in `InstallFrozenLockfile` and threaded through `CreateVirtualStore` → `InstallPackageBySnapshot`.
- `snapshot_cache_key` returns `Ok(None)` for `Git` resolutions so they cold-batch. Warm prefetch for git-hosted slots is a follow-up alongside §C.

### Supporting changes

- `GitResolution.path: Option<String>` so a lockfile pinning a sub-directory of a git-hosted monorepo deserializes without tripping `deny_unknown_fields`.
- `Config::git_shallow_hosts` with pnpm's default list + `pnpm-workspace.yaml` override.
- `pacquet_executor::run_lifecycle_hook` is now `pub` so the preparePackage port can dispatch by arbitrary stage name.

## Out of scope (follow-ups for #436)

- §C — git-hosted *tarball* fetcher (the `gitHosted: true` shape).
- §E — full integration-test matrix (`plans/TEST_PORTING.md` 563-572). This PR ships crate-level tests against a local bare repo that prove the path works end-to-end.
- Warm prefetch for git resolutions (re-clones on every install today — slow but correct).
- Full `npm-packlist` semantics (`.npmignore`, gitignore layering, `bundleDependencies` walking).