Add a `satisfies_package_manifest` check to pacquet's frozen-lockfile
dispatcher so a stale `pnpm-lock.yaml` no longer silently installs
the wrong shape of `node_modules`. Mirrors upstream's gate at
[pkg-manager/core/src/install/index.ts:808-832](https://github.com/pnpm/pnpm/blob/94240bc046/pkg-manager/core/src/install/index.ts#L808-L832):
before linking, compare the lockfile importer entry against the
on-disk `package.json` and fail with `ERR_PNPM_OUTDATED_LOCKFILE`
when they diverge.

The check (ported from upstream's
[`satisfiesPackageManifest`](https://github.com/pnpm/pnpm/blob/94240bc046/lockfile/verification/src/satisfiesPackageManifest.ts))
runs two passes:

1. Flat-record specifier diff over `dependencies ∪ devDependencies ∪
   optionalDependencies`. Catches added / removed / modified deps in
   one bucket; renders as a `SpecDiff` listing each entry per
   category so the user sees exactly what drifted.
2. Per-field name-set + specifier match. Catches the
   same-name-same-specifier-moved-between-buckets case the flat-
   record diff doesn't see (e.g. `react` moved from
   `dependencies` to `devDependencies`).

Reasons are surfaced as typed `StalenessReason` variants so
`pacquet-package-manager`'s `InstallError::OutdatedLockfile`
forwards a structured detail rather than a parsed string. The new
`InstallError::NoImporter` distinguishes "lockfile file is missing"
(`NoLockfile`) from "lockfile is present but has no importer entry
for this project."

Scoped to what pacquet supports today — no catalogs, no auto-
install-peers pre-pass, no `excludeLinksFromLockfile`, no semver-
range satisfies check (covered in pnpm's `localTarballDepsAreUpToDate`
which lives outside this gate). Multi-importer support comes when
workspace install (#431) lands.

Closes #447.

Seven fixes from Copilot review on #450:

- Per-field check now runs unconditionally so it catches same-
  cardinality cross-field swaps (e.g. lockfile prod={a}, dev={b} vs
  manifest prod={b}, dev={a}). The flat-union diff matches in this
  case because the union stays identical — only the per-field
  comparison sees the field-level mismatch.
- Implemented `publishDirectory` and `dependenciesMeta` checks the
  module had declared in `StalenessReason` but never emitted.
  Mirrors upstream's `satisfiesPackageManifest.ts:51-58`.
  `dependenciesMeta` treats absent and empty-object as equivalent
  (matching upstream's `?? {}` coercion).
- `SpecDiff::Display` now uses singular wording when n==1
  ("1 dependency was added" instead of "1 dependencies were added").
- `OutdatedLockfile`'s help text no longer suggests
  `pacquet install --no-frozen-lockfile` (which doesn't exist);
  points users at `pnpm install --lockfile-only` to regenerate.
- `NoImporter` messages now use `importers["."]` formatting
  instead of `{:?}` debug-format quoting that rendered short keys
  awkwardly as `importers."."`. Applied to both the
  `StalenessReason::NoImporter` and `InstallError::NoImporter`
  display impls.
- Test sites that mutate the manifest in-memory via
  `add_dependency` now also call `manifest.save()`, in case future
  code paths start re-reading `package.json` from disk.

Added three new tests pinning the new behaviors:
`cross_field_swap_with_same_cardinalities_caught_by_per_field_check`,
`publish_directory_mismatch_returns_publish_directory_mismatch`,
`dependencies_meta_mismatch_returns_dependencies_meta_mismatch`,
`no_importer_message_uses_bracket_quoted_id`,
`spec_diff_display_uses_singular_for_count_of_one`. Updated the
existing `spec_diff_display_lists_added_removed_modified` test to
use n=2 for the plural arm so the pluralization wording is also
pinned.

`[SpecDiff::Display]` doesn't resolve — `Display` is a trait impl, not
an associated item — so rustdoc fails with `unresolved link` under
`-D rustdoc::broken-intra-doc-links` (caught by the Doc CI job, not
`just ready` locally). Refer to it as "[SpecDiff]'s Display impl"
instead.

Surveyed upstream's `satisfiesPackageManifest` test file
(<https://github.com/pnpm/pnpm/blob/94240bc046/lockfile/verification/test/satisfiesPackageManifest.ts>)
and found one behavioral gap and three uncovered cases.

**Behavioral gap.** Upstream's per-field check filters a dep out of
the `devDependencies` check when it also appears in `dependencies`
or `optionalDependencies` (precedence: optional > prod > dev). My
port did not, so a manifest listing the same dep in both prod and
dev fields would incorrectly fail the dev-field check against a
lockfile that records it under prod only. Add the filter at the
per-field loop in `freshness.rs`.

**Three previously-uncovered upstream test cases ported:**

- `dependencies_meta_empty_object_equivalent_to_absent` —
  `dependenciesMeta: {}` on manifest with no `dependenciesMeta` on
  importer satisfies (the absent/empty equivalence already worked,
  just wasn't pinned by a test).
- `publish_directory_match_satisfies` — happy path for
  publishDirectory (previously only the mismatch case was tested).
- `same_dep_in_prod_and_dev_counts_under_prod` and
  `same_dep_in_prod_and_optional_counts_under_optional` — the
  precedence-filter behavior fixed above.
- `importer_empty_dev_dependencies_equivalent_to_absent` — the
  importer side's `Some(empty)` vs `None` equivalence.

Tests upstream covers that remain out of scope for pacquet:
`link:` deps (#431), `autoInstallPeers` peer-folding (pacquet has
no separate auto-install-peers mode), `excludeLinksFromLockfile`,
semver-range satisfies check (lives in upstream's
`localTarballDepsAreUpToDate`, out of scope per #447).

722 tests now run (+5 from the porting). All checks green
(`just ready`, `just dylint`, `cargo doc -D warnings`, `taplo`).