… upstream (#436 §E)

Ports five new tests against the local-bare-repo and write-to-CAS
fixtures already established by §B+D and §C, plus the TEST_PORTING.md
checkbox updates for the test-matrix subset that ship today (15
items checked off; the rest are noted with concrete reasons —
either Stage 2 resolver work, real-npm requirements, perf
benchmarks, or follow-up tests that need a PATH-shim helper).

New tests (`crates/git-fetcher/src/fetcher/tests.rs`):

- `fetcher_packs_subfolder_when_path_set` — ports `fetching/git-
  fetcher/test/index.ts:69`. Builds a tiny monorepo bare repo,
  runs `GitFetcher` with `path: Some("packages/sub")`, asserts the
  returned `cas_paths` only contain files relative to the sub-dir
  (never sibling packages, never carrying the `packages/` prefix).
- `fetcher_handles_repo_without_package_json` — ports
  `fetching/git-fetcher/test/index.ts:150`. A repo with no
  `package.json` at root still imports cleanly: `prepare_package`
  returns `should_be_built: false` (no manifest means nothing to
  build), and the fetcher hands the install dispatcher the files
  the packlist found.
- `fetcher_skips_build_when_ignore_scripts` — ports
  `fetching/git-fetcher/test/index.ts:247`. A repo whose
  `scripts.prepare` would fail if it ran (`exit 1`) still produces
  a successful fetcher run when `ignore_scripts: true`; observing
  success proves the lifecycle runner never spawned. Pins the
  `should_be_built: true` short-circuit so callers know the
  package wanted a build.

New tests (`crates/git-fetcher/src/tarball_fetcher/tests.rs`):

- `tarball_path_traversal_attack_is_rejected` — ports
  `fetching/tarball-fetcher/test/fetch.ts:610`. `path:
  Some("../escape")` must surface as `INVALID_PATH` from
  `prepare_package`'s `safe_join_path` before any extraction.
- `tarball_path_to_missing_subdir_is_rejected` — ports
  `fetching/tarball-fetcher/test/fetch.ts:637`. `path:
  Some("does/not/exist")` for a tarball that doesn't contain the
  sub-dir must surface as `INVALID_PATH` rather than silently
  packing the root.

`plans/TEST_PORTING.md` updates: marked 15 §E items as `[x]` with
links to the covering pacquet test name. Deferrals carry concrete
reasons (Stage 2 resolver, real-npm dependency, perf benchmark, or
PATH-shim helper). Existing test-suite total goes from 765 → 842
(local `just ready`).

…explain should_be_built vs key dim (#462 review)

CodeRabbit pointed out the visual inconsistency in
`fetcher_skips_build_when_ignore_scripts`: `files_index_file` carried
`\tnot-built` while `received.built` asserted `true`. The two are
different concepts but the test made them look conflated.

- Switch the key to `\tbuilt` so it matches what pacquet's dispatcher
  currently passes (the dispatcher hardcodes `built=true`; upstream
  would flip this with `!ignore_scripts` once pacquet adds the
  ignore-scripts config knob — both sites move together at that
  point).
- Comment at the call site spells out the relationship: the key's
  `built` dimension is what `pickStoreIndexKey` produces from the
  dispatcher's POV (currently always `built`), while `received.built`
  is `prepare_package`'s `should_be_built` flag (does the manifest
  declare a build?). These can disagree — exactly the state this
  test exercises.
- `assert!` message restated to highlight that `should_be_built`
  reports the manifest's *intent*, not whether scripts ran.

No production code touched; pure test clarity.