…review)

Five review findings from Copilot, all legitimate:

1. `hoist_into_root` did `root_deps.iter().find(...)` per visited
   edge — O(root_degree) per edge, O(N²) on a flat graph. Mirror
   root's direct deps into a `HashMap<String, RcByPtr<…>>` index
   maintained alongside the `IndexSet`, so the per-edge "is this
   name taken?" check stays O(1). The IndexSet remains
   authoritative for insertion order; the index is a side cache
   updated whenever a child is hoisted in.

2. `one_transitive_dep_hoists_to_root`'s `assert_eq!(names,
   ["a","b"])` depended on BFS insertion order. Sort first so the
   test pins membership, not traversal order.

3. `diamond_dep_hoists_once_to_root`'s `all_bs.len() == 1` check
   was tautological — `find` returns at most one. The intended
   property (identity dedup across the full result graph) wasn't
   actually being checked. Replace with a DFS that collects every
   distinct `Rc` allocation whose `name == "b"` and asserts the
   set has exactly one entry.

4. `version_conflict_keeps_loser_at_parent` and
   `transitive_npm_alias_resolves_target_snapshot` asserted on
   `references.borrow().iter().next()`. That's order-dependent
   even when there's only one entry today; once the algorithm
   starts accumulating references (peer-dependency work), it
   could regress to silent ordering bugs. Switch to
   `.contains(expected)` plus an explicit `.len()` check.

All 8 tests pass. `just ready`, `cargo doc
--document-private-items`, `taplo format --check`, `just dylint`
clean.

Coderabbit flagged that the algorithm silently accepts inputs it
doesn't model — peer-constrained packages, non-empty
`hoisting_limits`, and multi-importer (workspace) lockfiles — and
returns a layout that looks plausible but doesn't match what pnpm
would produce. A future caller wiring this into the install
pipeline before the peer / limits / workspace sub-slices land
would silently emit wrong `node_modules`.

Add three new `HoistError` variants and check them upfront:

- `UnsupportedPeerDependency { ident, peers }` — scan the
  constructed `HoisterTree` after the wrapper builds it; if any
  node has non-empty `peer_names` (either declared
  `peerDependencies` from the `packages:` map or
  `transitive_peer_dependencies` on a `snapshots:` entry), surface
  the offending package's snapshot key and the peer set.
- `UnsupportedHoistingLimits { len }` — refuse non-empty
  `opts.hoisting_limits`.
- `UnsupportedWorkspace { extra_importers }` — refuse lockfiles
  with any importer beyond the root `.`.

Each variant carries enough context for the operator to identify
what triggered it and points at the umbrella's sub-slices that
will lift the restriction.

Three new tests pin each guard. Existing 8 tests still pass — none
of them use peers, limits, or extra importers.

Adding `find_first_peer_constrained` between the doc block and
`nm_hoist` accidentally orphaned the algorithm's documentation
onto the wrong function: the long "what this models / doesn't
model" block ended up describing `find_first_peer_constrained`
while `nm_hoist` itself was undocumented. Split them so each
function carries its own docs, and update the "what this does not
model yet" section to note that peer-constrained inputs are now
refused by the wrapper before they reach this function.

…review)

Five review findings from Copilot, all legitimate:

1. `hoist_into_root` did `root_deps.iter().find(...)` per visited
   edge — O(root_degree) per edge, O(N²) on a flat graph. Mirror
   root's direct deps into a `HashMap<String, RcByPtr<…>>` index
   maintained alongside the `IndexSet`, so the per-edge "is this
   name taken?" check stays O(1). The IndexSet remains
   authoritative for insertion order; the index is a side cache
   updated whenever a child is hoisted in.

2. `one_transitive_dep_hoists_to_root`'s `assert_eq!(names,
   ["a","b"])` depended on BFS insertion order. Sort first so the
   test pins membership, not traversal order.

3. `diamond_dep_hoists_once_to_root`'s `all_bs.len() == 1` check
   was tautological — `find` returns at most one. The intended
   property (identity dedup across the full result graph) wasn't
   actually being checked. Replace with a DFS that collects every
   distinct `Rc` allocation whose `name == "b"` and asserts the
   set has exactly one entry.

4. `version_conflict_keeps_loser_at_parent` and
   `transitive_npm_alias_resolves_target_snapshot` asserted on
   `references.borrow().iter().next()`. That's order-dependent
   even when there's only one entry today; once the algorithm
   starts accumulating references (peer-dependency work), it
   could regress to silent ordering bugs. Switch to
   `.contains(expected)` plus an explicit `.len()` check.

All 8 tests pass. `just ready`, `cargo doc
--document-private-items`, `taplo format --check`, `just dylint`
clean.

Coderabbit flagged that the algorithm silently accepts inputs it
doesn't model — peer-constrained packages, non-empty
`hoisting_limits`, and multi-importer (workspace) lockfiles — and
returns a layout that looks plausible but doesn't match what pnpm
would produce. A future caller wiring this into the install
pipeline before the peer / limits / workspace sub-slices land
would silently emit wrong `node_modules`.

Add three new `HoistError` variants and check them upfront:

- `UnsupportedPeerDependency { ident, peers }` — scan the
  constructed `HoisterTree` after the wrapper builds it; if any
  node has non-empty `peer_names` (either declared
  `peerDependencies` from the `packages:` map or
  `transitive_peer_dependencies` on a `snapshots:` entry), surface
  the offending package's snapshot key and the peer set.
- `UnsupportedHoistingLimits { len }` — refuse non-empty
  `opts.hoisting_limits`.
- `UnsupportedWorkspace { extra_importers }` — refuse lockfiles
  with any importer beyond the root `.`.

Each variant carries enough context for the operator to identify
what triggered it and points at the umbrella's sub-slices that
will lift the restriction.

Three new tests pin each guard. Existing 8 tests still pass — none
of them use peers, limits, or extra importers.

Adding `find_first_peer_constrained` between the doc block and
`nm_hoist` accidentally orphaned the algorithm's documentation
onto the wrong function: the long "what this models / doesn't
model" block ended up describing `find_first_peer_constrained`
while `nm_hoist` itself was undocumented. Split them so each
function carries its own docs, and update the "what this does not
model yet" section to note that peer-constrained inputs are now
refused by the wrapper before they reach this function.

## Summary

Lifts the previous `UnsupportedPeerDependency` upfront guard and replaces it with the real peer check from upstream's `getNodeHoistInfo`. The hoister now accepts lockfiles whose packages declare peer dependencies and produces the layout pnpm would: a peer-constrained dep only floats up to the root when doing so doesn't change which package its peers resolve to.

## How it works

- `HoisterResult` carries the input `peer_names` set forward. Upstream's `HoisterResult` doesn't (peer info lives on its intermediate `HoisterWorkTree`); pacquet runs the algorithm on `HoisterResult` directly, so the peer set rides along.

- The hoist driver is a recursive `hoist_subtree` that walks the result graph depth-first. Each recursion receives the candidate parent's *current* ancestor path (`Vec<Rc<HoisterResult>>` exclusive of the parent). After a child's hoist decision is applied, the path passed into the child's recursion reflects its *new* position — a freshly-hoisted child recurses with `[root]`, a child that stayed nested recurses with `parent_path + [parent]`. (An earlier version of this PR used BFS with paths captured at queue time; that path went stale whenever a node was hoisted between being queued and dequeued, leading to over-refused hoists. The recursive form was Copilot's recommendation in code review; the bug regression is pinned by `peer_check_uses_post_hoist_ancestor_path_not_queue_time_path`.)

- `would_shadow_peer` walks that path to decide whether a candidate hoist would change its own peer resolution.

- New `AbsorbDecision::PeerShadow` variant alongside `Free` / `SameNode` / `Conflict`. Fires when:
  1. Root declares the candidate's own name as a peer (root-shadow guard — vacuous today since the wrapper's `.` root has empty `peer_names`, kept for parity).
  2. For each peer name `P` the candidate declares, the closest ancestor providing `P` does so with a different ident than the root's `P`. Promoting the candidate would silently re-resolve the peer.

- The previous `UnsupportedPeerDependency` error variant and `find_first_peer_constrained` upfront scan are gone. The `#[non_exhaustive]` tag stays so future variants can be added without breaking callers.

## DAG-vs-tree caveat

Upstream's `cloneTree` duplicates the work tree into a strict tree per parent path, so each candidate visit has a unique ancestor chain. Pacquet preserves the DAG (its identity-dedup is a feature) and records only the path DFS actually used to reach the candidate. In the rare case where the same `Rc` is reachable through both a peer-compatible and a peer-shadowing path, pacquet refuses to hoist — the layout ends up at most over-nested, never under-nested. The trade-off is documented on `would_shadow_peer`.

## Upstream reference

- [`hoist.ts:414`](https://github.com/yarnpkg/berry/blob/4287909fa6a0a1ec976a55776bff606864b31990/packages/yarnpkg-nm/sources/hoist.ts#L414) — root-shadow guard.
- [`hoist.ts:454-479`](https://github.com/yarnpkg/berry/blob/4287909fa6a0a1ec976a55776bff606864b31990/packages/yarnpkg-nm/sources/hoist.ts#L454-L479) — ancestor-path peer check.
- [`hoist.ts:670`](https://github.com/yarnpkg/berry/blob/4287909fa6a0a1ec976a55776bff606864b31990/packages/yarnpkg-nm/sources/hoist.ts#L670) — `cloneTree`, the per-path-tree shape pacquet skips.

## Test plan

- [x] `peer_constrained_node_stays_under_parent_when_root_provides_different_ident` — `app → widget (peer: react) + react@17`, `root → react@18`. widget cannot hoist because hoisting would change its peer to react@18.
- [x] `peer_constrained_node_hoists_when_ancestor_and_root_agree` — same shape but `app → react@18` matches root's `react@18` (shared `Rc` via wrapper dedup), so widget hoists freely.
- [x] `peer_check_uses_post_hoist_ancestor_path_not_queue_time_path` — regression for the BFS-stale-path bug Copilot caught. `root → app → mid → terminal` (peer: `react`) where `mid` hoists past a conflicting `app.react@17`. Under the previous BFS the stale path `[root, app, mid]` made `terminal`'s peer check trip on `app.react@17 ≠ root.react@18` and refuse the hoist; under DFS the actual post-hoist path `[root, mid]` finds no provider mismatch and `terminal` correctly flattens to root.
- [x] All 10 pre-existing tests still pass (`one_transitive_dep_hoists_to_root`, `diamond_dep_hoists_once_to_root`, `version_conflict_keeps_loser_at_parent`, `deep_chain_flattens_in_one_pass`, `transitive_npm_alias_resolves_target_snapshot`, `non_empty_hoisting_limits_surfaces_unsupported`, `multi_importer_lockfile_surfaces_unsupported_workspace`, `external_dependencies_are_stripped_from_the_result`, `empty_lockfile_yields_empty_root`, `hoist_throws_on_broken_lockfile`).
- [x] The previously-failing `peer_dependency_in_lockfile_surfaces_unsupported` test from #452 is replaced (peers are no longer an unsupported input).
- [x] All Copilot review threads addressed and resolved (stale ancestor path, misleading comment).
- [x] `just ready` (836 tests pass), `cargo doc --document-private-items`, `taplo format --check`, `just dylint` all clean.

Pull in 28 commits from upstream main, including the
`pacquet-npmrc` → `pacquet-config` rename (#420) plus features:
- supportedArchitectures + --cpu/--os/--libc (#456)
- frozen-lockfile (#442, #443, #447, #450)
- git-fetcher (#436 / #446, #451, #454)
- side-effects cache (#421 / #422, #423, #424)
- real-hoist + global-virtual-store (#432 / #438 / #444, #449, #452)
- patchedDependencies + allow-builds (#425, #427, #428)
- engine/platform installability (#434 / #439)

Conflicts resolved:
- `crates/npmrc/` files migrated under the renamed
  `crates/config/` directory; `Npmrc` → `Config` everywhere
  except `NpmrcAuth` (which keeps the `.npmrc`-domain name).
- `Config::current` reads the env-var DI generic `Api: EnvVar`
  for ${VAR}-substitution in `.npmrc`. Production turbofish in
  `cli_args.rs` is `Config::current::<RealApi, _, _, _, _>(...)`.
- Two-phase `NpmrcAuth::apply_*` retained so default-registry
  creds key at the yaml-resolved registry URL.
- New `Config::auth_headers` field plumbed through
  `install_package_by_snapshot`'s `DownloadTarballToStore`.
- Tests under `crates/config/src/workspace_yaml/tests.rs`
  pick up the new ParseYaml unit test added on this branch.