…e payload (#434 slice 4)

Slices 1–3 (#439, #456, #467) close the installability-driven skip
path end to end. This slice adds the second skip pathway upstream
handles in the frozen install: an `optional: true` snapshot whose
tarball / metadata / extract step fails at install time must not
abort the install. Mirrors pnpm/pnpm@94240bc046's silent
catch sites at
`deps/graph-builder/src/lockfileToDepGraph.ts:294-298` and
`installing/deps-restorer/src/index.ts:912-921`:

  try { ... fetch ... }
  catch (err) { if (pkgSnapshot.optional) return; throw err; }

The reporter side gains the `ResolutionFailure` sibling payload
the doc comment at `crates/reporter/src/lib.rs:546-562` had been
flagging. Defined for the resolver-side emit at
`installing/deps-resolver/src/resolveDependencies.ts:1376-1383`;
pacquet has no resolver so the variant is wire-shape-only until a
resolver port lands. Models upstream's discriminated union at
`core-loggers/src/skippedOptionalDependencyLogger.ts:10-31`.

## Changes

- `SkippedOptionalPackage` becomes a `#[serde(untagged)]` enum with
  `Installed { id, name, version }` and
  `ResolutionFailure { name?, version?, bareSpecifier }` variants.
  Two new wire-shape tests pin the resolution-failure payload.
- `SkippedSnapshots` gains a `fetch_failed` subset disjoint from
  the `installability` subset:
    - `contains` / `iter` return the union (downstream consumers
      should treat both as absent).
    - `iter_installability` returns only the persistent subset —
      `.modules.yaml.skipped` writes that, matching upstream's
      behavior of never updating `opts.skipped` at fetch-failure
      catch sites (a future install retries the URL).
- `CreateVirtualStoreOutput` carries the per-install
  `fetch_failed: HashSet<PackageKey>`; the cold-batch dispatch in
  `CreateVirtualStore::run` swallows the per-snapshot error when
  `snapshot.optional` is true. A non-optional failure still
  propagates.
- `InstallFrozenLockfile::run` folds the returned `fetch_failed`
  into its mutable `SkippedSnapshots`, so the downstream phases
  (`SymlinkDirectDependencies`, `LinkVirtualStoreBins`,
  `BuildModules`, hoist) skip the dropped snapshots through the
  same gate they already use for installability skips.

## Tests

- `reporter::tests::skipped_optional_resolution_failure_event_matches_pnpm_wire_shape`
  pins the full payload (`bareSpecifier` camelCase, no `id`).
- `reporter::tests::skipped_optional_resolution_failure_omits_absent_name_and_version`
  pins the optional-field shape.
- `install::tests::frozen_install_silently_swallows_unreachable_optional_tarball`
  ports `installing/deps-restorer/test/index.ts:340` —
  unreachable optional tarball, install succeeds, slot not
  created, `.modules.yaml.skipped` left empty. Test-the-test
  verified by removing the `optional`-guard in the cold-batch
  match arm.
- `install::tests::frozen_install_propagates_non_optional_fetch_failure`
  pins the polarity: same fixture, non-optional snapshot, install
  must error.

Closes #471.

…iants + GVS-off in tests

Addresses PR #474 review comments:

1. **Swallow scoping** (CodeRabbit major): `InstallPackageBySnapshotError`
   carries both fetch-side variants (`DownloadTarball`, `GitFetch`)
   and post-fetch variants (`CreateVirtualDir`, plus the
   config-shape `MissingTarballIntegrity` / `UnsupportedResolution`).
   Upstream's catch at
   `deps/graph-builder/src/lockfileToDepGraph.ts:286-298` wraps
   `storeController.fetchPackage` only — the local materialization
   (`linkPkg`) sits outside. Restrict pacquet's swallow accordingly
   via `is_fetch_side_failure`, so a local link error on an
   optional snapshot still aborts the install. Side benefit: the
   warm-batch path (which only surfaces `CreateVirtualDir` errors)
   stays consistently abort-on-error without a parallel swallow
   site.

2. **Test diagnostic** (CodeRabbit minor): add `dbg!(&json)` and
   include `{json:?}` in the `version` assertion message on
   `skipped_optional_resolution_failure_omits_absent_name_and_version`
   so failures self-diagnose under nextest.

3. **GVS-off in tests** (Copilot): both new
   `frozen_install_{silently_swallows,propagates_non_optional}`
   tests now explicitly `config.enable_global_virtual_store = false`.
   The swallow test's path assertion targets the legacy
   `<virtual_store_dir>/<flat-name>` slot — with GVS on the slot
   lives elsewhere and the assertion would always pass regardless
   of the swallow firing. Same pattern as
   `warm_reinstall_skips_snapshot_when_current_lockfile_matches`.

…site locality

Copilot review on PR #474 pointed out that the doc comment claimed
emit sites are "centralized inside this crate" but the actual
emitters live in `pacquet-package-manager` — `installability.rs`
(slice 1), `build_modules.rs` (build-failure), and now
`create_virtual_store.rs` (slice 4 fetch-failure swallow). Reword
to name those sites explicitly and acknowledge the
reason/package pairing is convention-driven, not type-enforced.

…e list

Copilot follow-up on the previous fix: `CreateVirtualStore`'s
slice 4 fetch-failure path is silent on the reporter wire — it
swallows the error without emitting `pnpm:skipped-optional-dependency`
(matches upstream's `lockfileToDepGraph.ts:294-298` catch). So
it's not a constructor site for this log type. Reword the doc
comment to list only the actual emit sites (`installability.rs`
and `build_modules.rs`) and explicitly note that the slice 4 path
is silent.