…acklist (#436 §C)

Builds on §B+D (#446). Adds the second half of the git-hosted install
path: `TarballResolution { gitHosted: true }` lockfile entries now run
through a new `GitHostedTarballFetcher` after the existing
`DownloadTarballToStore` settles their bytes into CAS. Mirrors pnpm's
[`gitHostedTarballFetcher.ts`](https://github.com/pnpm/pnpm/blob/94240bc046/fetching/tarball-fetcher/src/gitHostedTarballFetcher.ts):

  1. Materialize the CAS-resident files into a writable temp dir
     (`fs::copy` per file — using hardlinks here would let prepare
     scripts mutate shared CAS entries).
  2. Run the existing `prepare_package` port — same `<pm>-install` +
     `prepublish` / `prepack` / `publish` dispatch §B+D shipped,
     same `GIT_DEP_PREPARE_NOT_ALLOWED` gate.
  3. Run the existing minimal `packlist` over the prepared tree to
     drop source maps, test fixtures, etc. that ship in the raw
     archive but not in the published file set.
  4. Re-import the filtered file set back into CAS and hand the
     `HashMap<String, PathBuf>` to `CreateVirtualDirBySnapshot`.

The CAS-import helpers (`import_into_cas`, `is_file_executable`,
`map_write_cas`) and the new `materialize_into` lift out of
`fetcher.rs` into a shared `cas_io` module so both fetchers consume
the same code path. No public-API change there — the helpers stay
`pub(crate)`.

Supporting changes:

- `TarballResolution.path: Option<String>` mirrors pnpm's
  `TarballResolution.path` so a lockfile pinning a git-hosted tarball
  from a monorepo (`path: packages/sub`) deserializes without
  tripping `deny_unknown_fields`. The fetcher threads this through to
  `prepare_package`'s `safe_join_path` so the prepare and packlist
  run inside the right sub-directory.
- The install dispatcher hoists the `allow_build` closure and the
  `ScriptsPrependNodePath` conversion above the resolution match so
  both the `Git` arm and the new `gitHosted: true` post-pass borrow
  from the same locals — no temp closures across `.await`.

Out of scope (still open on #436):

- Warm prefetch for git-hosted slots — neither fetcher writes
  `gitHostedStoreIndexKey` rows to `index.db` yet, so a re-install
  re-runs the clone + prepare + packlist. Correct, but slow on the
  second run.
- Two-slot CAS layout (`${filesIndexFile}\traw` + final). Upstream
  optimizes "raw file set == prepared file set" by promoting the
  raw entry in place. Pacquet always re-imports today; hash-dedup
  means duplicate work but not duplicate storage.
- §E — full integration-test matrix in `plans/TEST_PORTING.md`.
  This PR ships four crate-level tests for `GitHostedTarballFetcher`
  (pass-through, files-field filter, `GIT_DEP_PREPARE_NOT_ALLOWED`,
  CAS-isolation regression).

…C review)

CodeRabbit flagged that `materialize_into` and `import_into_cas` both
joined a caller-supplied `rel` onto a trusted root without checking
the components. A malicious tarball entry like `../etc/passwd` would
have escaped the working tree on extraction. Pacquet's tarball
extractor is supposed to sanitise on the way in, but defense-in-depth
at this layer means a bug there can't turn into a write outside the
target directory.

Add a private `join_checked(root, rel)` helper in `cas_io` that:

- Rejects absolute paths (`/etc/passwd`, `C:\foo`).
- Rejects `..`, root, and drive-prefix components.
- Strips `.` components silently.
- Pushes only `Component::Normal` segments onto `root`.

Both `materialize_into` and `import_into_cas` route their joins
through it. Errors surface as `GitFetcherError::Io` with
`io::ErrorKind::InvalidInput` so the miette source chain remains
unchanged. A new test covers the rejection paths (absolute, parent-
dir at start, parent-dir mid-path) plus a regression test for
`materialize_into` that asserts no file lands outside the target on
a poisoned `cas_paths` entry.

… path/round-trip tests (#436 §C review round 2)

Addresses the second batch of CodeRabbit comments on #451:

- `install_package_by_snapshot.rs`: expand the doc comment on
  `InstallPackageBySnapshotError::GitFetch` to cover both fetchers
  (the git-CLI path for `type: git` and the git-hosted-tarball
  post-pass for `gitHosted: true`). The variant already wrapped
  `GitFetcherError`, which spans both — the doc was just out of date.
- `tarball_fetcher.rs`: drop the `wrap_prepare_error` helper. Its
  docstring claimed it stamped a "Failed to prepare git-hosted
  package" prefix, but the body was a one-line `Prepare(err)`
  passthrough. Inline the `map_err` at the call site and explain the
  upstream-vs-pacquet difference (we lean on the miette source chain
  + dispatcher log line for the prefix rather than mutating
  `err.message`) in a comment next to the call.
- `tarball_fetcher/tests.rs`: add `path_field_packs_only_subdirectory`
  pinning that a `path: Some("packages/sub")` resolution returns
  files relative to the sub-dir, never including sibling-package
  files or carrying the monorepo-root prefix.
- `lockfile/resolution/tests.rs`: add `serialize_tarball_resolution_with_path`
  so the new `TarballResolution.path` field has a serialization
  round-trip alongside its deserialization assertion. Mirrors the
  pattern `GitResolution.path` already follows.

 §C review round 3)

`materialize_into` and `import_into_cas` both ran
`rel.replace('/', std::path::MAIN_SEPARATOR_STR)` before handing the
path to `join_checked`, allocating a fresh `String` per file. CodeRabbit
pointed out that `Path::components()` (which `join_checked` already
uses) recognises both `/` and `\` as separators on Windows, so the
replace is unnecessary on every platform.

For a 1352-package install that's 1352+ avoided allocations per fetcher
pass. Pass `rel` straight to `join_checked` instead, with a short
comment at each call site explaining why.