Two cleanups while rebasing on top of #442 (partial frozen install):

- `install.rs`: the comment at the `<virtual_store_dir>/lock.yaml`
  write site referenced #431 as future work. With workspace install
  now landing in this PR, refresh the wording to call out that we
  *do* ship every importer's section unchanged, and the remaining
  narrowing (selected importers × engine filter) is gated on
  `--filter` (Stage 2 of #299).
- `root_finder/tests.rs`: rustfmt collapses the if/else closures
  introduced in a0d4df8 to single-line `if … else …` form. Apply
  it once here so the diff doesn't keep returning across runs.

---
Written by an agent (Claude Code, claude-opus-4-7).

After rebasing onto current main (#442 — partial install with
--frozen-lockfile) the CI clippy gate fires two errors I missed
locally:

- `get_subgraph_to_build` had 8 parameters after the `skipped`
  thread-through (clippy::too_many_arguments, threshold 7). Bundle
  the 4 read-only inputs (`children`, `requires_build`, `patches`,
  `skipped`) into a `GetSubgraphCtx` struct; the 3 `&mut`
  accumulators stay as plain params. 5 total now.
- `Some(list) if list.is_empty()` in `platform_axis_meaningful` is
  clippy::redundant_guards. Use the empty-slice pattern
  (`Some([])`) and the single-element pattern (`Some([only]) if
  only == "any"`) so each pattern says what it matches without a
  separate guard clause.

The rebase itself: main's #442 added a per-snapshot "skip
already-installed-and-still-on-disk" pass in
`CreateVirtualStore::run`. Layered the installability skip on top
— it filters BEFORE that pass (installability-skipped snapshots
should never enter the install graph at all, including the
`skipped_entries` cache-key lane that #442 keeps warm for the
build-cache lookup).

Two cleanups while rebasing on top of #442 (partial frozen install):

- `install.rs`: the comment at the `<virtual_store_dir>/lock.yaml`
  write site referenced #431 as future work. With workspace install
  now landing in this PR, refresh the wording to call out that we
  *do* ship every importer's section unchanged, and the remaining
  narrowing (selected importers × engine filter) is gated on
  `--filter` (Stage 2 of #299).
- `root_finder/tests.rs`: rustfmt collapses the if/else closures
  introduced in a0d4df8 to single-line `if … else …` form. Apply
  it once here so the diff doesn't keep returning across runs.

---
Written by an agent (Claude Code, claude-opus-4-7).

After rebasing onto current main (#442 — partial install with
--frozen-lockfile) the CI clippy gate fires two errors I missed
locally:

- `get_subgraph_to_build` had 8 parameters after the `skipped`
  thread-through (clippy::too_many_arguments, threshold 7). Bundle
  the 4 read-only inputs (`children`, `requires_build`, `patches`,
  `skipped`) into a `GetSubgraphCtx` struct; the 3 `&mut`
  accumulators stay as plain params. 5 total now.
- `Some(list) if list.is_empty()` in `platform_axis_meaningful` is
  clippy::redundant_guards. Use the empty-slice pattern
  (`Some([])`) and the single-element pattern (`Some([only]) if
  only == "any"`) so each pattern says what it matches without a
  separate guard clause.

The rebase itself: main's #442 added a per-snapshot "skip
already-installed-and-still-on-disk" pass in
`CreateVirtualStore::run`. Layered the installability skip on top
— it filters BEFORE that pass (installability-skipped snapshots
should never enter the install graph at all, including the
`skipped_entries` cache-key lane that #442 keeps warm for the
build-cache lookup).

Two cleanups while rebasing on top of #442 (partial frozen install):

- `install.rs`: the comment at the `<virtual_store_dir>/lock.yaml`
  write site referenced #431 as future work. With workspace install
  now landing in this PR, refresh the wording to call out that we
  *do* ship every importer's section unchanged, and the remaining
  narrowing (selected importers × engine filter) is gated on
  `--filter` (Stage 2 of #299).
- `root_finder/tests.rs`: rustfmt collapses the if/else closures
  introduced in a0d4df8 to single-line `if … else …` form. Apply
  it once here so the diff doesn't keep returning across runs.

---
Written by an agent (Claude Code, claude-opus-4-7).

After rebasing onto current main (#442 — partial install with
--frozen-lockfile) the CI clippy gate fires two errors I missed
locally:

- `get_subgraph_to_build` had 8 parameters after the `skipped`
  thread-through (clippy::too_many_arguments, threshold 7). Bundle
  the 4 read-only inputs (`children`, `requires_build`, `patches`,
  `skipped`) into a `GetSubgraphCtx` struct; the 3 `&mut`
  accumulators stay as plain params. 5 total now.
- `Some(list) if list.is_empty()` in `platform_axis_meaningful` is
  clippy::redundant_guards. Use the empty-slice pattern
  (`Some([])`) and the single-element pattern (`Some([only]) if
  only == "any"`) so each pattern says what it matches without a
  separate guard clause.

The rebase itself: main's #442 added a per-snapshot "skip
already-installed-and-still-on-disk" pass in
`CreateVirtualStore::run`. Layered the installability skip on top
— it filters BEFORE that pass (installability-skipped snapshots
should never enter the install graph at all, including the
`skipped_entries` cache-key lane that #442 keeps warm for the
build-cache lookup).

Two issues flagged by Copilot on #449:

1. `build_modules::virtual_store_dir_for_key` was calling
   `layout.slot_dir(&bare_key)` after peer-stripping the snapshot
   key. `VirtualStoreLayout` keys its precomputed GVS suffixes by
   the *full* snapshot key (with the peer suffix), so the lookup
   missed for peer-resolved snapshots and fell through to the
   legacy flat-name path — pointing at a directory
   `CreateVirtualDirBySnapshot` never created. Effect: build
   scripts silently skipped for peer-resolved packages. Switched
   the lookup to the full `key`; the package-name segment still
   comes from the peer-stripped key.

2. `CreateVirtualStore::run`'s partial-install skip probe (added
   in #442) still hard-coded
   `config.virtual_store_dir.join(to_virtual_store_name)`, which
   is the legacy layout. Under GVS-on the slot lives at
   `layout.slot_dir(snapshot_key)`, so warm slots were being
   classified as missing and `BrokenModules` emitted for the
   wrong path. Routed through the layout to match what the actual
   install / link steps use.

#442's three partial-install tests
(`warm_reinstall_skips_snapshot_when_current_lockfile_matches`,
`warm_reinstall_emits_broken_modules_when_dir_is_missing`,
`warm_reinstall_reports_added_zero_and_emits_no_imported_events`)
seeded `<virtual_store_dir>/<flat-name>` slots manually — the
legacy shape. With the probe now routed through the layout under
default GVS-on, those legacy seeds no longer match. Each test
sets `enable_global_virtual_store = false` so the seeded layout
matches the probe; the partial-install behaviour under test is
independent of the GVS layout, and the GVS-on dispatch is
exercised by the `frozen_lockfile_*_gvs_*` tests.

All 704 workspace tests pass; taplo / dylint / cargo doc clean.

…incompatibles (#434 slice 1) (#439)

Slice 1 of #434 — foundational installability gate. Ports
[`@pnpm/config.package-is-installable`](https://github.com/pnpm/pnpm/tree/94240bc046/config/package-is-installable)
and threads the resulting skip-set through every phase of the
frozen-lockfile install pipeline.

Closes #266 once shipped (covers the "install respects every snapshot
— no os/cpu/libc filter" gap). Does **not** close #434 — that umbrella
has six more slices to follow.

Upstream reference: pnpm/pnpm@94240bc046.

## What landed

### New crate: `pacquet-package-is-installable`

Ports the upstream `config/package-is-installable` package's three
helpers:

- `check_platform` (`Option<&[String]>` for each `os`/`cpu`/`libc`
  axis, plus a `SupportedArchitectures` override) — returns
  `Option<UnsupportedPlatformError>` matching upstream's
  `ERR_PNPM_UNSUPPORTED_PLATFORM` code, message shape, and JSON
  payload. Handles negation entries (`!foo`), the `any` sentinel,
  the `current` placeholder, and the `currentLibc !== 'unknown'`
  skip from `checkPlatform.ts:38`.
- `check_engine` — evaluates `engines.node` / `engines.pnpm` via
  `node-semver`. Approximates npm-semver's `includePrerelease: true`
  via a strip-prerelease fallback; one over-acceptance edge case
  (`>=X.Y.Z` against `X.Y.Z-rc1`) is pinned in the known-failures
  integration test for follow-up.
- `package_is_installable` — composes the two, returns the
  tri-state verdict matching upstream's `boolean | null` (Installable
  / SkipOptional / ProceedWithWarning), plus an `Err` arm for
  `engine_strict` aborts and `ERR_PNPM_INVALID_NODE_VERSION`.

`InstallabilityOptions<'a>` borrows its host strings so a caller
running through many snapshots in a row can build the host part
once and only toggle `optional` per snapshot. `WantedPlatformRef<'a>`
plays the same role for the manifest axes so `check_platform` runs
the happy path without any allocation.

### New module: `pacquet_package_manager::installability`

`compute_skipped_snapshots` is the per-install entry point. For each
snapshot:

1. Look up the matching `PackageMetadata`.
2. Run `check_package` (cached per peer-stripped `metadata_key` so
   peer-resolved variants of the same package share one verdict).
3. Dispatch on `(verdict, snapshot.optional, host.engine_strict)`:
   - `Installable`: nothing to do.
   - `SkipOptional` + `optional`: add to `SkippedSnapshots`, emit
     `pnpm:skipped-optional-dependency` (deduped per metadata key,
     matching upstream's emit-per-pkgId).
   - `Incompatible` + non-optional + `engine_strict`: abort.
   - `Incompatible` + non-optional + non-strict: `tracing::warn!`
     and proceed. (Upstream's `pnpm:install-check` channel isn't
     wired into pacquet's reporter yet — slice 1 follow-up.)

`any_installability_constraint(packages)` is the caller-side fast
path: if no metadata row declares an `engines.{node,pnpm}` or a
non-empty / non-`["any"]` `cpu`/`os`/`libc`, the entire installability
pass is skipped. The probe runs synchronously in
`install_frozen_lockfile` *before* the `tokio::task::spawn_blocking`
that would invoke `node --version` — so the common no-constraints
lockfile pays nothing for the new pipeline, restoring main's overlap
of node-binary startup with extraction.

### Install-pipeline plumbing

The `SkippedSnapshots` set is threaded into every downstream phase
of `InstallFrozenLockfile::run`:

- `CreateVirtualStore`: installability-skipped snapshots are
  dropped from both `survivors` (no virtual-store slot extracted)
  and `skipped_entries` (no warm-cache row). Layered ahead of
  main's #442 already-installed-and-on-disk skip filter.
- `SymlinkDirectDependencies`: a direct dep whose resolved
  snapshot is in the skip set is omitted from `node_modules/<name>`
  (no symlink, no `pnpm:root added` event, no bin link).
- `LinkVirtualStoreBins`: per-slot bin link skips slots whose
  snapshot is installability-skipped (their virtual-store
  directories don't exist).
- `BuildModules` via `build_sequence`: `get_subgraph_to_build`
  consults `skipped` *before* recursion, so a skipped snapshot's
  subtree doesn't contribute to the build graph via that edge.
  Descendants reachable from a non-skipped root still build
  normally.

### Performance

CI integrated-benchmark on the 1352-package fixture, latest run:

| Scenario | `pacquet@HEAD` | `pacquet@main` | Relative |
|---|---|---|---|
| Frozen Lockfile (cold) | 2.476 ± 0.083 s | 2.442 ± 0.071 s | 1.01 ± 0.05 |
| Frozen Lockfile (Hot Cache) | 685.8 ± 59.3 ms | 700.2 ± 47.4 ms | 1.00 |

Earlier iterations of this PR showed a ~5% cold-install regression
from the `node --version` spawn landing on the extraction critical
path. Closed by hoisting the no-constraints fast-path probe to the
caller (commit `cf47ce51`) so the spawn is gated on actual
constraint presence.

Other perf passes folded in:

- `compute_skipped_snapshots` caches the per-metadata-row check
  verdict so peer-resolved variants share one `check_package` call.
- `check_platform` borrows its three wanted axes through
  `WantedPlatformRef<'a>`; the owned `WantedPlatform` only
  materialises in the error path.

## Tests

| Suite | Count | What it covers |
|---|---|---|
| `pacquet-package-is-installable::tests::check_platform` | 16 | Port of upstream `checkPlatform.ts` — `any`/`current` sentinels, negation, `supportedArchitectures` override, libc unknown-skip |
| `pacquet-package-is-installable::tests::check_engine` | 7 | Port of upstream `checkEngine.ts` — node/pnpm range checks, prerelease cases, `ERR_PNPM_INVALID_NODE_VERSION` |
| `pacquet-package-is-installable::tests::package_is_installable` | 6 | Tri-state verdict + optional/engine-strict dispatch |
| `pacquet-package-is-installable::tests::known_failures` | 1 | The `>=X.Y.Z` vs `X.Y.Z-rc1` over-acceptance, picked up by `just known-failures` |
| `pacquet_package_manager::installability::tests` | 11 | Per-install skip-set computation: skip on bad OS, skip on bad node engine, dedup events across peer variants, fast-path triggers, constraint predicate's edge cases (`engines.npm` only, `["any"]` sentinel, empty lists) |
| `pacquet_package_manager::build_sequence::tests` | 3 (new) | Skipped+patched doesn't enter build queue; skipped parent doesn't drag descendants in; descendant with non-skipped parent still builds |

All ported tests verified to catch regressions by temporarily
breaking the subject under test, observing the failure, then
reverting. The "test the tests" workflow from CLAUDE.md.

## Deferred to follow-up slices

- `.modules.yaml.skipped` write/read + headless re-check
  (slice 3).
- `supportedArchitectures` config + `--cpu` / `--os` / `--libc`
  CLI flags (slice 2).
- `pnpm:install-check` warn channel on the reporter side
  (currently `tracing::warn!`).
- Real libc detection — `host_libc()` returns `"unknown"` today;
  matches non-Linux host behavior, but on Alpine/musl this
  over-installs glibc-only optional packages. Slice 2.
- `engine_strict` config wiring — defaults to false today, so
  the error path is unreachable from production. Wired through
  end-to-end so the slice that flips the config doesn't churn
  the error enum.

Two cleanups while rebasing on top of #442 (partial frozen install):

- `install.rs`: the comment at the `<virtual_store_dir>/lock.yaml`
  write site referenced #431 as future work. With workspace install
  now landing in this PR, refresh the wording to call out that we
  *do* ship every importer's section unchanged, and the remaining
  narrowing (selected importers × engine filter) is gated on
  `--filter` (Stage 2 of #299).
- `root_finder/tests.rs`: rustfmt collapses the if/else closures
  introduced in a0d4df8 to single-line `if … else …` form. Apply
  it once here so the diff doesn't keep returning across runs.

---
Written by an agent (Claude Code, claude-opus-4-7).

Two issues flagged by Copilot on #449:

1. `build_modules::virtual_store_dir_for_key` was calling
   `layout.slot_dir(&bare_key)` after peer-stripping the snapshot
   key. `VirtualStoreLayout` keys its precomputed GVS suffixes by
   the *full* snapshot key (with the peer suffix), so the lookup
   missed for peer-resolved snapshots and fell through to the
   legacy flat-name path — pointing at a directory
   `CreateVirtualDirBySnapshot` never created. Effect: build
   scripts silently skipped for peer-resolved packages. Switched
   the lookup to the full `key`; the package-name segment still
   comes from the peer-stripped key.

2. `CreateVirtualStore::run`'s partial-install skip probe (added
   in #442) still hard-coded
   `config.virtual_store_dir.join(to_virtual_store_name)`, which
   is the legacy layout. Under GVS-on the slot lives at
   `layout.slot_dir(snapshot_key)`, so warm slots were being
   classified as missing and `BrokenModules` emitted for the
   wrong path. Routed through the layout to match what the actual
   install / link steps use.

(`warm_reinstall_skips_snapshot_when_current_lockfile_matches`,
`warm_reinstall_emits_broken_modules_when_dir_is_missing`,
`warm_reinstall_reports_added_zero_and_emits_no_imported_events`)
seeded `<virtual_store_dir>/<flat-name>` slots manually — the
legacy shape. With the probe now routed through the layout under
default GVS-on, those legacy seeds no longer match. Each test
sets `enable_global_virtual_store = false` so the seeded layout
matches the probe; the partial-install behaviour under test is
independent of the GVS layout, and the GVS-on dispatch is
exercised by the `frozen_lockfile_*_gvs_*` tests.

All 704 workspace tests pass; taplo / dylint / cargo doc clean.

Two cleanups while rebasing on top of #442 (partial frozen install):

- `install.rs`: the comment at the `<virtual_store_dir>/lock.yaml`
  write site referenced #431 as future work. With workspace install
  now landing in this PR, refresh the wording to call out that we
  *do* ship every importer's section unchanged, and the remaining
  narrowing (selected importers × engine filter) is gated on
  `--filter` (Stage 2 of #299).
- `root_finder/tests.rs`: rustfmt collapses the if/else closures
  introduced in a0d4df8 to single-line `if … else …` form. Apply
  it once here so the diff doesn't keep returning across runs.

---
Written by an agent (Claude Code, claude-opus-4-7).

Two cleanups while rebasing on top of #442 (partial frozen install):

- `install.rs`: the comment at the `<virtual_store_dir>/lock.yaml`
  write site referenced #431 as future work. With workspace install
  now landing in this PR, refresh the wording to call out that we
  *do* ship every importer's section unchanged, and the remaining
  narrowing (selected importers × engine filter) is gated on
  `--filter` (Stage 2 of #299).
- `root_finder/tests.rs`: rustfmt collapses the if/else closures
  introduced in a0d4df8 to single-line `if … else …` form. Apply
  it once here so the diff doesn't keep returning across runs.

---
Written by an agent (Claude Code, claude-opus-4-7).

Two issues flagged by Copilot on #449:

1. `build_modules::virtual_store_dir_for_key` was calling
   `layout.slot_dir(&bare_key)` after peer-stripping the snapshot
   key. `VirtualStoreLayout` keys its precomputed GVS suffixes by
   the *full* snapshot key (with the peer suffix), so the lookup
   missed for peer-resolved snapshots and fell through to the
   legacy flat-name path — pointing at a directory
   `CreateVirtualDirBySnapshot` never created. Effect: build
   scripts silently skipped for peer-resolved packages. Switched
   the lookup to the full `key`; the package-name segment still
   comes from the peer-stripped key.

2. `CreateVirtualStore::run`'s partial-install skip probe (added
   in #442) still hard-coded
   `config.virtual_store_dir.join(to_virtual_store_name)`, which
   is the legacy layout. Under GVS-on the slot lives at
   `layout.slot_dir(snapshot_key)`, so warm slots were being
   classified as missing and `BrokenModules` emitted for the
   wrong path. Routed through the layout to match what the actual
   install / link steps use.

(`warm_reinstall_skips_snapshot_when_current_lockfile_matches`,
`warm_reinstall_emits_broken_modules_when_dir_is_missing`,
`warm_reinstall_reports_added_zero_and_emits_no_imported_events`)
seeded `<virtual_store_dir>/<flat-name>` slots manually — the
legacy shape. With the probe now routed through the layout under
default GVS-on, those legacy seeds no longer match. Each test
sets `enable_global_virtual_store = false` so the seeded layout
matches the probe; the partial-install behaviour under test is
independent of the GVS layout, and the GVS-on dispatch is
exercised by the `frozen_lockfile_*_gvs_*` tests.

All 704 workspace tests pass; taplo / dylint / cargo doc clean.

Two issues flagged by Copilot on #449:

1. `build_modules::virtual_store_dir_for_key` was calling
   `layout.slot_dir(&bare_key)` after peer-stripping the snapshot
   key. `VirtualStoreLayout` keys its precomputed GVS suffixes by
   the *full* snapshot key (with the peer suffix), so the lookup
   missed for peer-resolved snapshots and fell through to the
   legacy flat-name path — pointing at a directory
   `CreateVirtualDirBySnapshot` never created. Effect: build
   scripts silently skipped for peer-resolved packages. Switched
   the lookup to the full `key`; the package-name segment still
   comes from the peer-stripped key.

2. `CreateVirtualStore::run`'s partial-install skip probe (added
   in #442) still hard-coded
   `config.virtual_store_dir.join(to_virtual_store_name)`, which
   is the legacy layout. Under GVS-on the slot lives at
   `layout.slot_dir(snapshot_key)`, so warm slots were being
   classified as missing and `BrokenModules` emitted for the
   wrong path. Routed through the layout to match what the actual
   install / link steps use.

(`warm_reinstall_skips_snapshot_when_current_lockfile_matches`,
`warm_reinstall_emits_broken_modules_when_dir_is_missing`,
`warm_reinstall_reports_added_zero_and_emits_no_imported_events`)
seeded `<virtual_store_dir>/<flat-name>` slots manually — the
legacy shape. With the probe now routed through the layout under
default GVS-on, those legacy seeds no longer match. Each test
sets `enable_global_virtual_store = false` so the seeded layout
matches the probe; the partial-install behaviour under test is
independent of the GVS layout, and the GVS-on dispatch is
exercised by the `frozen_lockfile_*_gvs_*` tests.

All 704 workspace tests pass; taplo / dylint / cargo doc clean.

## Summary

Threads `VirtualStoreLayout` (from #444) through the frozen-lockfile install pipeline so packages installed with `enableGlobalVirtualStore: true` (pacquet's default since #444) land at the upstream-shaped `<store_dir>/links/<scope>/<name>/<version>/<hash>/node_modules/<pkg>` path. Closes the rest of #432 (Section B + C activation + D entry tests).

## Pipeline changes (frozen-lockfile path)

- `InstallFrozenLockfile::run` constructs the install-scoped `VirtualStoreLayout` from the lockfile + engine name + config, then threads `&VirtualStoreLayout` through `CreateVirtualStore`, `CreateVirtualDirBySnapshot`, `create_symlink_layout`, `SymlinkDirectDependencies`, `InstallPackageBySnapshot`, `BuildModules`, and `LinkVirtualStoreBins`. Every site that used to compute `virtual_store_dir.join(key.to_virtual_store_name())` now goes through one `layout.slot_dir(key)` lookup.
- `Install::run` calls `pacquet_store_dir::register_project` **once per importer** when `enable_global_virtual_store` is on, writing `<store_dir>/projects/<short-hash>` per workspace package so a future `pacquet store prune` can find every reachable consumer of `<store_dir>/links/...`. Best-effort: registry write failures degrade to `tracing::warn!` and the install continues. The walk runs *after* `InstallFrozenLockfile::run` succeeds so importer keys have already been validated.
- `Config::current` now applies `apply_global_virtual_store_derivation` after yaml — pacquet's variant of upstream's [`extendInstallOptions.ts:343-355`](https://github.com/pnpm/pnpm/blob/94240bc046/installing/deps-installer/src/install/extendInstallOptions.ts#L343-L355). An explicit `globalVirtualStoreDir:` in yaml wins over the derivation; otherwise the field falls back to the user's pinned `virtualStoreDir` (under GVS-on) or to `<store_dir>/links`.

## Field-split deviation from upstream

Upstream pnpm *mutates* `virtualStoreDir` in place under GVS, so every consumer that reads `virtualStoreDir` sees `<storeDir>/links`. Pacquet keeps `virtual_store_dir` at its project-local value and writes the GVS path into the separate `global_virtual_store_dir` field. The frozen-lockfile path consumes `global_virtual_store_dir` through `VirtualStoreLayout`; the legacy non-frozen `InstallWithoutLockfile` keeps reading `virtual_store_dir` (now via `VirtualStoreLayout::legacy`). The split is a pacquet-only concern: upstream has no without-lockfile install path and so doesn't need the second field. See the doc on `Config::apply_global_virtual_store_derivation` for the reasoning.

## Benchmarks

The integrated-benchmark fixture pins `enableGlobalVirtualStore: false` so existing scenarios continue to compare apples-to-apples against the project-local `<modules>/.pnpm/<flat-name>` shape. Without the pin, every revision newer than this PR would silently switch to the GVS layout, while `pacquet@main` and the pnpm side of the comparison would still use the isolated layout — different shape, unfair comparison. GVS-specific benchmark runs are available by passing `--fixture-dir <dir>` at a copy of the fixture with the flag flipped.

## Tests

- `install::tests::frozen_lockfile_under_gvs_registers_project_and_runs_clean` pins the registry write under default GVS-on (single-project case).
- `install::tests::frozen_lockfile_under_gvs_registers_each_workspace_importer` pins per-importer registration: workspace root + `packages/web` each end up with their own symlink in `<store_dir>/projects/`.
- `install::tests::frozen_lockfile_with_gvs_off_skips_project_registry` pins that GVS-off opts out of the registry write.
- `config::tests::yaml_global_virtual_store_dir_wins_over_derivation` pins the yaml-override precedence.
- All **829 workspace tests** pass under the new layout-threaded path.
- Existing per-snapshot legacy tests construct `VirtualStoreLayout::legacy(...)` explicitly so they keep asserting the flat-name layout regardless of any global default. Partial-install tests from #442 pin `enable_global_virtual_store = false` so their seeded legacy-shape slots match the probe path.

End-to-end port of upstream's [`installing/deps-installer/test/install/globalVirtualStore.ts`](https://github.com/pnpm/pnpm/blob/94240bc046/installing/deps-installer/test/install/globalVirtualStore.ts) is tracked as a follow-up — those tests need a small frozen-lockfile fixture against the registry-mock that doesn't exist yet.

Pull in 28 commits from upstream main, including the
`pacquet-npmrc` → `pacquet-config` rename (#420) plus features:
- supportedArchitectures + --cpu/--os/--libc (#456)
- frozen-lockfile (#442, #443, #447, #450)
- git-fetcher (#436 / #446, #451, #454)
- side-effects cache (#421 / #422, #423, #424)
- real-hoist + global-virtual-store (#432 / #438 / #444, #449, #452)
- patchedDependencies + allow-builds (#425, #427, #428)
- engine/platform installability (#434 / #439)

Conflicts resolved:
- `crates/npmrc/` files migrated under the renamed
  `crates/config/` directory; `Npmrc` → `Config` everywhere
  except `NpmrcAuth` (which keeps the `.npmrc`-domain name).
- `Config::current` reads the env-var DI generic `Api: EnvVar`
  for ${VAR}-substitution in `.npmrc`. Production turbofish in
  `cli_args.rs` is `Config::current::<RealApi, _, _, _, _>(...)`.
- Two-phase `NpmrcAuth::apply_*` retained so default-registry
  creds key at the yaml-resolved registry URL.
- New `Config::auth_headers` field plumbed through
  `install_package_by_snapshot`'s `DownloadTarballToStore`.
- Tests under `crates/config/src/workspace_yaml/tests.rs`
  pick up the new ParseYaml unit test added on this branch.