Pacquet's CLI already exposes `--no-optional` and threads it as a
`DependencyGroup` filter through `Install::dependency_groups`. The
flag is honored by `SymlinkDirectDependencies` (which already
filters by group) and by the on-disk `.modules.yaml.included`
field, but the rest of the install pipeline walks the lockfile's
`optional_dependencies` maps unconditionally — so the optional
subtree was still extracted, linked, and built even when the user
asked it to be skipped.

This slice closes that gap by adding the same filter upstream
applies at
`installing/deps-installer/src/install/link.ts:109-111` to
pacquet's centralized skip-set plumbing:

- `SkippedSnapshots` gains a third disjoint subset
  `optional_excluded` alongside `installability` (slice 1) and
  `fetch_failed` (slice 4). `contains` / `iter` already return the
  union, so every downstream consumer that filters by skip-set
  (`CreateVirtualStore`, `SymlinkDirectDependencies`,
  `BuildModules`, hoist, link_bins) now respects `--no-optional`
  through the same gate.
- `iter_installability` still returns only the persistent subset
  for `.modules.yaml.skipped` writes — `--no-optional` exclusions
  are transient (matching upstream's behavior of never adding to
  `opts.skipped` at the filter site), so a later install without
  `--no-optional` brings the snapshots back into the install graph.
- `InstallFrozenLockfile::run` iterates the lockfile snapshots
  once after the installability + seed pass and inserts every
  `snap.optional == true` entry into the new subset when the
  dispatch list doesn't contain `DependencyGroup::Optional`. The
  `SnapshotEntry::optional` flag is set by the resolver only when
  the snapshot is reachable **exclusively** through optional
  edges, so a snapshot reachable both optionally and non-optionally
  carries `optional: false` and survives the filter — covers
  upstream's `optionalDependencies.ts:712` case (`dependency that
  is both optional and non-optional is installed`).

Tests:

- `install::tests::frozen_install_no_optional_drops_optional_only_snapshots`
  uses a discriminating fixture: an `optional: true` snapshot whose
  metadata row is missing from `packages:`. Slice 4 (fetch-failure
  swallow) only covers `DownloadTarball`/`GitFetch` so
  `MissingPackageMetadata` propagates even on optional — meaning
  install success proves the snapshot was dropped **before**
  cache-key derivation by the slice 5 filter. Test-the-test:
  inverting the `!include_optional` guard surfaces
  `MissingPackageMetadata`.
- `install::tests::frozen_install_optional_included_surfaces_missing_metadata`
  pins the polarity: same fixture, `Optional` in the dispatch list,
  install must abort with `MissingPackageMetadata`.

Out of scope:
- `installing only optional deps` — pacquet has no CLI flag for that yet.
- `optional dependency has bigger priority than regular dependency` — resolver-side priority rule.
- Current-lockfile pruning when the include set changes between installs — umbrella slice 6.

Closes #480.

…ared-dep regression test

Addresses PR #485 review:

- **CodeRabbit + Copilot (×2)**: `add_optional_excluded` and
  `add_fetch_failed` inserted unconditionally, which let the same
  key live in multiple subsets when overlaps occur (the realistic
  case: a platform-incompatible optional snapshot installed with
  `--no-optional` would land in both `installability` and
  `optional_excluded`). That made `len()` overcount and `iter()`
  emit duplicates, breaking the disjoint-subset invariant
  `contains` already promised.

  Fix: write-time guards. `add_fetch_failed` no-ops if
  `installability` already has the key; `add_optional_excluded`
  no-ops if either `installability` or `fetch_failed` does. The
  precedence is "installability wins" (it's the only persistent
  subset, so a snapshot recorded as installability-skipped should
  stay that way on the next install's seed). New unit tests
  `disjoint_subsets_preserve_len_and_iter` and
  `fetch_failed_takes_precedence_over_optional_excluded` pin the
  invariant — test-the-test verified by removing the guards.

- **Copilot**: missing regression test for the shared-dependency
  case from `optionalDependencies.ts:712`. Added
  `frozen_install_no_optional_keeps_shared_non_optional_snapshot`:
  fixture has a snapshot listed under `optionalDependencies` but
  with `optional: false` on the snapshot entry (the upstream
  resolver's marker for "reachable through any non-optional
  edge"). With `--no-optional`, the slice 5 filter must NOT drop
  this snapshot. Discriminating signal: metadata is missing from
  `packages:`, so a wrong drop would silently succeed; a correct
  install instead aborts with `MissingPackageMetadata`.

… Debug substring

CodeRabbit review on PR #485 flagged that
`msg.contains("MissingPackageMetadata")` couples the test to
`Debug` formatting — a rename or surrounding-context shift would
silently break the assertion's discrimination. Replace both
sites in the slice 5 install tests with a typed `matches!` on
the full error chain:

  InstallError::FrozenLockfile(
    InstallFrozenLockfileError::CreateVirtualStore(
      CreateVirtualStoreError::MissingPackageMetadata { .. },
    ),
  )

Test intent now lives in the type system rather than in a debug
string; both tests still pass.

…mmetric fetch_failed guard

PR #485 review (Copilot, 2026-05-13):

- **Hoist symlink pass missed the skip filter**:
  `get_hoisted_dependencies` records `(child_id, alias) → kind`
  in `hoisted_dependencies_by_node_id` before the skipped guard at
  hoist.rs:388, and the symlink pass walks every entry. So a prod
  dep with an optional transitive child could still get a hoisted
  symlink to a slot `CreateVirtualStore` skipped — dangling on
  Unix, failing as a junction on Windows. The
  `graph.get(node_id)` guard isn't enough because `build_hoist_graph`
  doesn't filter by skip (it includes every snapshot whose
  metadata is present). Fix: thread the skip set into
  `symlink_hoisted_dependencies` and short-circuit there. Updated
  the call site in `InstallFrozenLockfile::run` to pass the
  existing `hoist_skipped` set.

  New unit test `hoist::tests::symlink_skips_dropped_nodes`
  exercises the pass directly: two nodes, one in the skip set;
  the kept alias's symlink is created, the dropped alias has
  none. Uses `symlink_metadata` (not `exists`) to catch the
  dangling-symlink regression — `exists` follows the link so a
  dangling target would mask the bug. Test-the-test verified by
  removing the new filter.

  Also updates the misleading doc comment on
  `skipped_snapshot_is_excluded` that claimed `graph.get(node_id)`
  was the symlink-side guard.

- **`add_fetch_failed` lacked the symmetric guard against
  `optional_excluded`**: the public API now no-ops symmetrically
  with `add_optional_excluded` so call order can't corrupt the
  disjoint-subset invariant. The
  `fetch_failed_and_optional_excluded_are_symmetric` test now
  covers both insertion orders; renamed from the prior
  `_takes_precedence_over_` name to reflect the symmetric
  semantics. Test-the-test verified by removing the new guard.

- **Test comment typo**: `AddDependencyOptions::dependency_groups()`
  → `InstallDependencyOptions::dependency_groups()` in
  `frozen_install_no_optional_drops_optional_only_snapshots`. The
  install CLI uses the `Install` variant; `Add` lives in
  `cli_args/add.rs`.