After rebasing on top of #448 (new `pacquet-real-hoist` crate), the
lockfile-to-HoisterTree wrapper consumed `spec.version` expecting a
`PkgVerPeer` — but this PR widens `ResolvedDependencySpec.version` to
`ImporterDepVersion` so `link:` (cross-importer `workspace:*`) deps
can be represented. `link:` deps don't live in the virtual store, so
they have no snapshot to hoist; mirror the same skip that
`pacquet-package-manager`'s `build_sequence::collect_root_dep_paths`
already does and `continue` past `ImporterDepVersion::Link` values.

The matching `resolved_dep` test helper takes a `&str` literal and is
unit-test infrastructure, so a `.into()` from `PkgVerPeer` to
`ImporterDepVersion::Regular` is enough — no functional change.

---
Written by an agent (Claude Code, claude-opus-4-7).

After rebasing on top of #448 (new `pacquet-real-hoist` crate), the
lockfile-to-HoisterTree wrapper consumed `spec.version` expecting a
`PkgVerPeer` — but this PR widens `ResolvedDependencySpec.version` to
`ImporterDepVersion` so `link:` (cross-importer `workspace:*`) deps
can be represented. `link:` deps don't live in the virtual store, so
they have no snapshot to hoist; mirror the same skip that
`pacquet-package-manager`'s `build_sequence::collect_root_dep_paths`
already does and `continue` past `ImporterDepVersion::Link` values.

The matching `resolved_dep` test helper takes a `&str` literal and is
unit-test infrastructure, so a `.into()` from `PkgVerPeer` to
`ImporterDepVersion::Regular` is enough — no functional change.

---
Written by an agent (Claude Code, claude-opus-4-7).

After rebasing on top of #448 (new `pacquet-real-hoist` crate), the
lockfile-to-HoisterTree wrapper consumed `spec.version` expecting a
`PkgVerPeer` — but this PR widens `ResolvedDependencySpec.version` to
`ImporterDepVersion` so `link:` (cross-importer `workspace:*`) deps
can be represented. `link:` deps don't live in the virtual store, so
they have no snapshot to hoist; mirror the same skip that
`pacquet-package-manager`'s `build_sequence::collect_root_dep_paths`
already does and `continue` past `ImporterDepVersion::Link` values.

The matching `resolved_dep` test helper takes a `&str` literal and is
unit-test infrastructure, so a `.into()` from `PkgVerPeer` to
`ImporterDepVersion::Regular` is enough — no functional change.

---
Written by an agent (Claude Code, claude-opus-4-7).

After rebasing on top of #448 (new `pacquet-real-hoist` crate), the
lockfile-to-HoisterTree wrapper consumed `spec.version` expecting a
`PkgVerPeer` — but this PR widens `ResolvedDependencySpec.version` to
`ImporterDepVersion` so `link:` (cross-importer `workspace:*`) deps
can be represented. `link:` deps don't live in the virtual store, so
they have no snapshot to hoist; mirror the same skip that
`pacquet-package-manager`'s `build_sequence::collect_root_dep_paths`
already does and `continue` past `ImporterDepVersion::Link` values.

The matching `resolved_dep` test helper takes a `&str` literal and is
unit-test infrastructure, so a `.into()` from `PkgVerPeer` to
`ImporterDepVersion::Regular` is enough — no functional change.

---
Written by an agent (Claude Code, claude-opus-4-7).

## Summary

Replaces the stub `nm_hoist` (landed in #448) with a working hoister and the surrounding guardrails: BFS over the result graph pulling every eligible descendant up to the root, plus upfront refusal of inputs the algorithm doesn't yet model.

### What the algorithm models

- **Free hoist.** A transitive dep with no name collision at the root surfaces at the root.
- **Identity dedup.** A dep reachable through multiple parents shares one `Rc` thanks to the wrapper's cache; the hoist preserves that identity and strips the duplicate reference at the other parent path.
- **Parent-wins on version conflict.** When two distinct deps share an alias but resolve to different snapshot keys, the first BFS visitor takes the root slot and the other stays under its declaring parent. Visit order matches the wrapper's alias-sorted insertion order, so the outcome is deterministic.
- **Deep chains flatten in one pass.** `root → a → b → c → d` becomes `root → {a, b, c, d}` — each node, once hoisted, is queued for further descent; its own children evaluate against root's slots rather than against the (now-empty) intermediate parent.
- **O(1) root-slot lookup.** A side `HashMap<String, RcByPtr<HoisterResult>>` mirrors root's direct deps, so the per-edge "is this name taken?" check doesn't degrade to O(N²) `IndexSet` scans on flat graphs.

### Fail-fast guards

The algorithm doesn't yet model peers, hoisting limits, or multi-importer (workspace) hoist trees. Rather than emit a layout pnpm would reject, the wrapper refuses these inputs upfront with three new `HoistError` variants:

- `UnsupportedPeerDependency { ident, peers }` — fires when scanning the constructed `HoisterTree` finds any node with non-empty `peer_names` (either `peerDependencies` from the `packages:` map or `transitive_peer_dependencies` on a `snapshots:` entry).
- `UnsupportedHoistingLimits { len }` — non-empty `opts.hoisting_limits`.
- `UnsupportedWorkspace { extra_importers }` — any importer beyond the root `.`.

Each carries enough context for an operator to identify what triggered it. The `UnsupportedWorkspace` help points at `SymlinkDirectDependencies` — workspaces *do* work in pacquet's wider install path (workspace support landed in #443 for the isolated linker); only the hoister is restricted.

### Rebase pickup

`collect_importer_deps` carries the `Link`-variant skip introduced by #443 (workspace support) — `spec.version.as_regular()` extracts the snapshot key for `Regular` deps and `continue`s past `Link` deps, since workspace siblings are direct symlinks materialised by `SymlinkDirectDependencies` and have no snapshot to hoist.

### Performance

Nothing in this PR is reachable from `pacquet install` today (`crates/package-manager/src/install*.rs` doesn't import `pacquet-real-hoist` — the crate is dead code from the install pipeline's perspective until the hoisted-linker wiring lands in later slices). The benchmark results bear that out: cold Frozen Lockfile is within CI variance (+3.2% mean, +3.5% median, driven by one outlier), Hot Cache is 6% *faster* (same `stat → lstat` improvement that shipped in slice 1's `import_indexed_dir`), micro is identical. No code path explains a real regression.

## What's deferred

- Peer-dependency-aware hoisting (`peer_names` constraints, peer-promise satisfaction).
- Multi-round convergence — the BFS handles deep chains in one pass, so the cases requiring true multi-round are limited to peer interactions.
- `hoistingLimits` runtime enforcement.
- `dependencyKind` distinctions for workspaces and external soft links (today only `ExternalSoftLink` placeholders are added by the wrapper and stripped post-hoist; `Workspace`-kind nodes are blocked by the `UnsupportedWorkspace` guard upfront).

## Upstream reference

- [`hoist.ts` algorithm overview](https://github.com/yarnpkg/berry/blob/4287909fa6a0a1ec976a55776bff606864b31990/packages/yarnpkg-nm/sources/hoist.ts#L1-L51) — the recipe pacquet's single-pass BFS approximates.
- [`hoistTo` main loop](https://github.com/yarnpkg/berry/blob/4287909fa6a0a1ec976a55776bff606864b31990/packages/yarnpkg-nm/sources/hoist.ts#L329) — the structural intent the port mirrors for the subset above.