Six items from the Copilot review on #449:

1. **Gate `register_project` on frozen-lockfile** — the call previously
   fired for any GVS-on install, including the legacy
   `InstallWithoutLockfile` path that uses
   `VirtualStoreLayout::legacy` and never references
   `<store_dir>/links/...`. Tightened to
   `frozen_lockfile && config.enable_global_virtual_store` so a
   registry entry only appears for installs that actually consume the
   shared store.

2. **`VirtualStoreLayout::new` engine: `Option<&str>`** — the param
   was `&str` and the call site passed `engine_name.as_deref()
   .unwrap_or("")`, which turned a missing `node` into `Some("")` and
   hashed to a different value than `None` (the latter omits the
   `engine` contribution from `calc_graph_node_hash`). Switched the
   signature to `Option<&str>` and the call site to
   `engine_name.as_deref()` so the missing-engine case round-trips
   correctly. Test call sites updated.

3. **`run_emits_imported_event_after_create_cas_files`** — renamed to
   `run_emits_imported_event_after_import_indexed_dir` (and updated
   the doc comment) since `create_cas_files` was renamed to
   `import_indexed_dir` in #441.

4. **`VirtualStoreLayout::package_store_dir` doc** — the field doc
   still claimed the root was `Config::virtual_store_dir` in both
   modes. Updated to reflect the post-split design: it's
   `Config::global_virtual_store_dir` under GVS, `virtual_store_dir`
   otherwise.

5. **Test manifest placement** — the new
   `frozen_lockfile_under_gvs_registers_project_and_runs_clean` and
   `frozen_lockfile_with_gvs_off_skips_project_registry` tests
   created the manifest at `<tmp>/package.json` while
   `project_root` was `<tmp>/project/`. `Install::run` derives the
   registry target from `manifest.path().parent()`, so the registry
   entry actually pointed at `<tmp>`, not the intended project root.
   Moved the manifest into `project_root` and replaced the
   entry-count-only check with a `read_link` + canonicalize
   assertion that the symlink resolves back to `project_root`.

6. **Preserve yaml-set `globalVirtualStoreDir`** —
   `apply_global_virtual_store_derivation` unconditionally
   overwrote the field, so a user-pinned `globalVirtualStoreDir:` in
   `pnpm-workspace.yaml` was silently lost. Added a
   `global_virtual_store_dir_explicit` parameter that short-circuits
   the derivation when yaml provided the value, mirroring the
   pre-existing `virtual_store_dir_explicit` plumbing. New
   `yaml_global_virtual_store_dir_wins_over_derivation` test pins
   the behaviour.

All 704 workspace tests pass; `taplo --check`, `just dylint`,
`cargo doc -D warnings` clean.

Two issues flagged by Copilot on #449:

1. `build_modules::virtual_store_dir_for_key` was calling
   `layout.slot_dir(&bare_key)` after peer-stripping the snapshot
   key. `VirtualStoreLayout` keys its precomputed GVS suffixes by
   the *full* snapshot key (with the peer suffix), so the lookup
   missed for peer-resolved snapshots and fell through to the
   legacy flat-name path — pointing at a directory
   `CreateVirtualDirBySnapshot` never created. Effect: build
   scripts silently skipped for peer-resolved packages. Switched
   the lookup to the full `key`; the package-name segment still
   comes from the peer-stripped key.

2. `CreateVirtualStore::run`'s partial-install skip probe (added
   in #442) still hard-coded
   `config.virtual_store_dir.join(to_virtual_store_name)`, which
   is the legacy layout. Under GVS-on the slot lives at
   `layout.slot_dir(snapshot_key)`, so warm slots were being
   classified as missing and `BrokenModules` emitted for the
   wrong path. Routed through the layout to match what the actual
   install / link steps use.

#442's three partial-install tests
(`warm_reinstall_skips_snapshot_when_current_lockfile_matches`,
`warm_reinstall_emits_broken_modules_when_dir_is_missing`,
`warm_reinstall_reports_added_zero_and_emits_no_imported_events`)
seeded `<virtual_store_dir>/<flat-name>` slots manually — the
legacy shape. With the probe now routed through the layout under
default GVS-on, those legacy seeds no longer match. Each test
sets `enable_global_virtual_store = false` so the seeded layout
matches the probe; the partial-install behaviour under test is
independent of the GVS layout, and the GVS-on dispatch is
exercised by the `frozen_lockfile_*_gvs_*` tests.

All 704 workspace tests pass; taplo / dylint / cargo doc clean.

Six items from the Copilot review on #449:

1. **Gate `register_project` on frozen-lockfile** — the call previously
   fired for any GVS-on install, including the legacy
   `InstallWithoutLockfile` path that uses
   `VirtualStoreLayout::legacy` and never references
   `<store_dir>/links/...`. Tightened to
   `frozen_lockfile && config.enable_global_virtual_store` so a
   registry entry only appears for installs that actually consume the
   shared store.

2. **`VirtualStoreLayout::new` engine: `Option<&str>`** — the param
   was `&str` and the call site passed `engine_name.as_deref()
   .unwrap_or("")`, which turned a missing `node` into `Some("")` and
   hashed to a different value than `None` (the latter omits the
   `engine` contribution from `calc_graph_node_hash`). Switched the
   signature to `Option<&str>` and the call site to
   `engine_name.as_deref()` so the missing-engine case round-trips
   correctly. Test call sites updated.

3. **`run_emits_imported_event_after_create_cas_files`** — renamed to
   `run_emits_imported_event_after_import_indexed_dir` (and updated
   the doc comment) since `create_cas_files` was renamed to
   `import_indexed_dir` in #441.

4. **`VirtualStoreLayout::package_store_dir` doc** — the field doc
   still claimed the root was `Config::virtual_store_dir` in both
   modes. Updated to reflect the post-split design: it's
   `Config::global_virtual_store_dir` under GVS, `virtual_store_dir`
   otherwise.

5. **Test manifest placement** — the new
   `frozen_lockfile_under_gvs_registers_project_and_runs_clean` and
   `frozen_lockfile_with_gvs_off_skips_project_registry` tests
   created the manifest at `<tmp>/package.json` while
   `project_root` was `<tmp>/project/`. `Install::run` derives the
   registry target from `manifest.path().parent()`, so the registry
   entry actually pointed at `<tmp>`, not the intended project root.
   Moved the manifest into `project_root` and replaced the
   entry-count-only check with a `read_link` + canonicalize
   assertion that the symlink resolves back to `project_root`.

6. **Preserve yaml-set `globalVirtualStoreDir`** —
   `apply_global_virtual_store_derivation` unconditionally
   overwrote the field, so a user-pinned `globalVirtualStoreDir:` in
   `pnpm-workspace.yaml` was silently lost. Added a
   `global_virtual_store_dir_explicit` parameter that short-circuits
   the derivation when yaml provided the value, mirroring the
   pre-existing `virtual_store_dir_explicit` plumbing. New
   `yaml_global_virtual_store_dir_wins_over_derivation` test pins
   the behaviour.

All 704 workspace tests pass; `taplo --check`, `just dylint`,
`cargo doc -D warnings` clean.

Two issues flagged by Copilot on #449:

1. `build_modules::virtual_store_dir_for_key` was calling
   `layout.slot_dir(&bare_key)` after peer-stripping the snapshot
   key. `VirtualStoreLayout` keys its precomputed GVS suffixes by
   the *full* snapshot key (with the peer suffix), so the lookup
   missed for peer-resolved snapshots and fell through to the
   legacy flat-name path — pointing at a directory
   `CreateVirtualDirBySnapshot` never created. Effect: build
   scripts silently skipped for peer-resolved packages. Switched
   the lookup to the full `key`; the package-name segment still
   comes from the peer-stripped key.

2. `CreateVirtualStore::run`'s partial-install skip probe (added
   in #442) still hard-coded
   `config.virtual_store_dir.join(to_virtual_store_name)`, which
   is the legacy layout. Under GVS-on the slot lives at
   `layout.slot_dir(snapshot_key)`, so warm slots were being
   classified as missing and `BrokenModules` emitted for the
   wrong path. Routed through the layout to match what the actual
   install / link steps use.

(`warm_reinstall_skips_snapshot_when_current_lockfile_matches`,
`warm_reinstall_emits_broken_modules_when_dir_is_missing`,
`warm_reinstall_reports_added_zero_and_emits_no_imported_events`)
seeded `<virtual_store_dir>/<flat-name>` slots manually — the
legacy shape. With the probe now routed through the layout under
default GVS-on, those legacy seeds no longer match. Each test
sets `enable_global_virtual_store = false` so the seeded layout
matches the probe; the partial-install behaviour under test is
independent of the GVS layout, and the GVS-on dispatch is
exercised by the `frozen_lockfile_*_gvs_*` tests.

All 704 workspace tests pass; taplo / dylint / cargo doc clean.

Six items from the Copilot review on #449:

1. **Gate `register_project` on frozen-lockfile** — the call previously
   fired for any GVS-on install, including the legacy
   `InstallWithoutLockfile` path that uses
   `VirtualStoreLayout::legacy` and never references
   `<store_dir>/links/...`. Tightened to
   `frozen_lockfile && config.enable_global_virtual_store` so a
   registry entry only appears for installs that actually consume the
   shared store.

2. **`VirtualStoreLayout::new` engine: `Option<&str>`** — the param
   was `&str` and the call site passed `engine_name.as_deref()
   .unwrap_or("")`, which turned a missing `node` into `Some("")` and
   hashed to a different value than `None` (the latter omits the
   `engine` contribution from `calc_graph_node_hash`). Switched the
   signature to `Option<&str>` and the call site to
   `engine_name.as_deref()` so the missing-engine case round-trips
   correctly. Test call sites updated.

3. **`run_emits_imported_event_after_create_cas_files`** — renamed to
   `run_emits_imported_event_after_import_indexed_dir` (and updated
   the doc comment) since `create_cas_files` was renamed to
   `import_indexed_dir` in #441.

4. **`VirtualStoreLayout::package_store_dir` doc** — the field doc
   still claimed the root was `Config::virtual_store_dir` in both
   modes. Updated to reflect the post-split design: it's
   `Config::global_virtual_store_dir` under GVS, `virtual_store_dir`
   otherwise.

5. **Test manifest placement** — the new
   `frozen_lockfile_under_gvs_registers_project_and_runs_clean` and
   `frozen_lockfile_with_gvs_off_skips_project_registry` tests
   created the manifest at `<tmp>/package.json` while
   `project_root` was `<tmp>/project/`. `Install::run` derives the
   registry target from `manifest.path().parent()`, so the registry
   entry actually pointed at `<tmp>`, not the intended project root.
   Moved the manifest into `project_root` and replaced the
   entry-count-only check with a `read_link` + canonicalize
   assertion that the symlink resolves back to `project_root`.

6. **Preserve yaml-set `globalVirtualStoreDir`** —
   `apply_global_virtual_store_derivation` unconditionally
   overwrote the field, so a user-pinned `globalVirtualStoreDir:` in
   `pnpm-workspace.yaml` was silently lost. Added a
   `global_virtual_store_dir_explicit` parameter that short-circuits
   the derivation when yaml provided the value, mirroring the
   pre-existing `virtual_store_dir_explicit` plumbing. New
   `yaml_global_virtual_store_dir_wins_over_derivation` test pins
   the behaviour.

All 704 workspace tests pass; `taplo --check`, `just dylint`,
`cargo doc -D warnings` clean.

Two issues flagged by Copilot on #449:

1. `build_modules::virtual_store_dir_for_key` was calling
   `layout.slot_dir(&bare_key)` after peer-stripping the snapshot
   key. `VirtualStoreLayout` keys its precomputed GVS suffixes by
   the *full* snapshot key (with the peer suffix), so the lookup
   missed for peer-resolved snapshots and fell through to the
   legacy flat-name path — pointing at a directory
   `CreateVirtualDirBySnapshot` never created. Effect: build
   scripts silently skipped for peer-resolved packages. Switched
   the lookup to the full `key`; the package-name segment still
   comes from the peer-stripped key.

2. `CreateVirtualStore::run`'s partial-install skip probe (added
   in #442) still hard-coded
   `config.virtual_store_dir.join(to_virtual_store_name)`, which
   is the legacy layout. Under GVS-on the slot lives at
   `layout.slot_dir(snapshot_key)`, so warm slots were being
   classified as missing and `BrokenModules` emitted for the
   wrong path. Routed through the layout to match what the actual
   install / link steps use.

(`warm_reinstall_skips_snapshot_when_current_lockfile_matches`,
`warm_reinstall_emits_broken_modules_when_dir_is_missing`,
`warm_reinstall_reports_added_zero_and_emits_no_imported_events`)
seeded `<virtual_store_dir>/<flat-name>` slots manually — the
legacy shape. With the probe now routed through the layout under
default GVS-on, those legacy seeds no longer match. Each test
sets `enable_global_virtual_store = false` so the seeded layout
matches the probe; the partial-install behaviour under test is
independent of the GVS layout, and the GVS-on dispatch is
exercised by the `frozen_lockfile_*_gvs_*` tests.

All 704 workspace tests pass; taplo / dylint / cargo doc clean.

… sites added by GVS PR

`Install { ... }` literals at lines 1349, 1418, 1493 were added by
the global-virtual-store activation PR (#449) that landed on `main`
while this branch was open. They were missing the
`supported_architectures` field this PR introduced.

`None` for all three since none exercise platform-tagged optional
dependencies.

Workspace install (#431 / #443) and GVS install activation (#432 / #449)
both landed since the hoist work in #435 began. The rebase needed two
adjustments to keep the symlink target paths correct under GVS:

- `symlink_hoisted_dependencies` now takes `&VirtualStoreLayout`
  instead of `virtual_store_dir: &Path`. The symlink target (the
  source of each hoist symlink) goes through `layout.slot_dir(key)`,
  which under GVS resolves to
  `<store_dir>/links/<scope>/<name>/<version>/<hash>/` and falls
  back to the legacy `<virtual_store_dir>/<key.virtual_store_name>/`
  flat name when GVS is off. The hoist code never has to branch on
  `enable_global_virtual_store` itself.

- The private hoist *target dir* (where hoist symlinks live) stays
  `config.virtual_store_dir.join("node_modules")`. Pacquet keeps
  `virtual_store_dir` project-local even with GVS enabled — only
  `global_virtual_store_dir` carries the shared `<store_dir>/links`
  path (see `Config::apply_global_virtual_store_derivation`). So
  `<root>/node_modules/.pnpm/node_modules` is still the right
  placement under both modes; the GVS-rewire concern from the
  issue description doesn't apply to pacquet's split-field design.

Updated the call site comment to record this and dropped the stale
"GVS not implemented yet — tracked at #432" note.

Tests: `just ready` 894/894 pass; `cargo doc --workspace --no-deps`
with `RUSTDOCFLAGS="-D warnings"` clean; `just dylint` clean. The
full hoist CLI suite (36/36) and unit suite (12/12) still pass with
the GVS layout pulled into the symlink path.

Workspace install (#431 / #443) and GVS install activation (#432 / #449)
both landed since the hoist work in #435 began. The rebase needed two
adjustments to keep the symlink target paths correct under GVS:

- `symlink_hoisted_dependencies` now takes `&VirtualStoreLayout`
  instead of `virtual_store_dir: &Path`. The symlink target (the
  source of each hoist symlink) goes through `layout.slot_dir(key)`,
  which under GVS resolves to
  `<store_dir>/links/<scope>/<name>/<version>/<hash>/` and falls
  back to the legacy `<virtual_store_dir>/<key.virtual_store_name>/`
  flat name when GVS is off. The hoist code never has to branch on
  `enable_global_virtual_store` itself.

- The private hoist *target dir* (where hoist symlinks live) stays
  `config.virtual_store_dir.join("node_modules")`. Pacquet keeps
  `virtual_store_dir` project-local even with GVS enabled — only
  `global_virtual_store_dir` carries the shared `<store_dir>/links`
  path (see `Config::apply_global_virtual_store_derivation`). So
  `<root>/node_modules/.pnpm/node_modules` is still the right
  placement under both modes; the GVS-rewire concern from the
  issue description doesn't apply to pacquet's split-field design.

Updated the call site comment to record this and dropped the stale
"GVS not implemented yet — tracked at #432" note.

Tests: `just ready` 894/894 pass; `cargo doc --workspace --no-deps`
with `RUSTDOCFLAGS="-D warnings"` clean; `just dylint` clean. The
full hoist CLI suite (36/36) and unit suite (12/12) still pass with
the GVS layout pulled into the symlink path.

Pull in 28 commits from upstream main, including the
`pacquet-npmrc` → `pacquet-config` rename (#420) plus features:
- supportedArchitectures + --cpu/--os/--libc (#456)
- frozen-lockfile (#442, #443, #447, #450)
- git-fetcher (#436 / #446, #451, #454)
- side-effects cache (#421 / #422, #423, #424)
- real-hoist + global-virtual-store (#432 / #438 / #444, #449, #452)
- patchedDependencies + allow-builds (#425, #427, #428)
- engine/platform installability (#434 / #439)

Conflicts resolved:
- `crates/npmrc/` files migrated under the renamed
  `crates/config/` directory; `Npmrc` → `Config` everywhere
  except `NpmrcAuth` (which keeps the `.npmrc`-domain name).
- `Config::current` reads the env-var DI generic `Api: EnvVar`
  for ${VAR}-substitution in `.npmrc`. Production turbofish in
  `cli_args.rs` is `Config::current::<RealApi, _, _, _, _>(...)`.
- Two-phase `NpmrcAuth::apply_*` retained so default-registry
  creds key at the yaml-resolved registry URL.
- New `Config::auth_headers` field plumbed through
  `install_package_by_snapshot`'s `DownloadTarballToStore`.
- Tests under `crates/config/src/workspace_yaml/tests.rs`
  pick up the new ParseYaml unit test added on this branch.