…w-up)

Wires git-hosted installs into pacquet's existing `index.db` warm-cache
path so the second install of an unchanged lockfile reuses the previous
install's clone+checkout+prepare+packlist work instead of redoing it
from scratch.

Three pieces:

- **Both fetchers now write `PackageFilesIndex` rows.** `cas_io::
  import_into_cas` returns the full
  `HashMap<String, CafsFileInfo>` payload alongside the existing
  `cas_paths` map; the fetchers wrap that into a `PackageFilesIndex`
  and queue it on the shared `StoreIndexWriter` at the cache key the
  dispatcher passed in. `algo: "sha512"`, `manifest: None`,
  `requires_build` reflects `should_be_built`. `add_files_from_dir`'s
  `file_mode_from` is duplicated locally so the cache row encodes
  the same POSIX-mode shape pnpm's tarball entries use.
- **`create_virtual_store::snapshot_cache_key` routes git arms
  through the warm batch.** For `Tarball { gitHosted: true }` and
  `Git` resolutions it now returns
  `Some(gitHostedStoreIndexKey(pkg_id, built=true))` (matches
  upstream's `pickStoreIndexKey` shape) instead of the previous
  `None` cold-batch shortcut. `built = true` matches the dispatcher's
  `ignore_scripts: false` default; both sites will flip together
  when an `ignore-scripts` config knob lands.
- **Dispatcher threads writer + key into both fetchers.**
  `install_package_by_snapshot.rs` builds the same
  `gitHostedStoreIndexKey(package_id, built=true)` the warm path
  reads and hands it to `GitFetcher.files_index_file` /
  `GitHostedTarballFetcher.files_index_file`, plus the shared
  `store_index_writer` clone.

New test: `tarball_fetcher::tests::writes_index_row_when_writer_provided`
spawns a real `StoreIndexWriter`, runs the fetcher with it, awaits
the writer's join handle, and re-opens the store to confirm the row
landed at the expected `pkg_id\tbuilt` key with the right `algo`,
`requires_build`, and a non-empty `files` map.

The warm prefetch's existing file-verification (`check_pkg_files_integrity`)
runs unchanged — if any CAS file referenced by the row has been
pruned, the snapshot falls through to cold and the fetcher re-runs.

…#454 review)

CodeRabbit pointed out that the two `assert!(row.files.contains_key(...))`
calls in `writes_index_row_when_writer_provided` fail without showing
what keys were actually present, making CI triage slower. Collect the
keys once and pass them through to the assertion message so a failure
points at the discrepancy directly.

Pure test-readability change; no production code touched.

…for warm git prefetch (#454 coverage)

Closes the two coverage gaps identified during PR review:

- **`snapshot_cache_key` unit tests for git arms.** Two new tests
  in `create_virtual_store::tests` build a `PackageMetadata` with
  `LockfileResolution::Git` and `LockfileResolution::Tarball {
  gitHosted: true }` respectively and assert that
  `snapshot_cache_key` returns `Some("<pkg_id>\tbuilt")` — the same
  `gitHostedStoreIndexKey(pkg_id, built=true)` shape both fetchers
  write at install time. Drift between the read and write sides
  would silently degrade every git-hosted re-install to the cold
  path; pinning the shape on both sides keeps them in lock-step.
- **Richer `CafsFileInfo` round-trip assertions.** The existing
  `writes_index_row_when_writer_provided` round-trip checked only
  `algo`, `requires_build`, and key presence. Now it also asserts
  the per-file entry's `digest` is non-empty + ASCII-hex, `mode`
  rounds to `0o644` on a non-executable regular file, `size`
  matches the source bytes, and `checked_at` is `None` (matches
  `add_files_from_dir`'s convention — the first integrity-check
  pass stamps it). Drift in any of these would surface as a warm-
  prefetch cache miss instead of a clean fail, so explicit
  assertions catch the regression at unit-test time.

No production code changes; pure coverage. Existing tests still
green at 767 (765 + the 2 new `snapshot_cache_key` tests).