#4 (cmd-shim — chmod target swallowed all errors): the post-write
\`ensure_executable_bits\` call used \`let _ = ...\` which dropped
\`PermissionDenied\`, \`EROFS\`, AppArmor deny and other real failures
alongside the intentionally-ignored \`NotFound\`. Match \`NotFound\`
explicitly and propagate everything else as \`LinkBinsError::Chmod\`,
mirroring pnpm's \`fixBin\` ENOENT guard. Adds two DI-driven
regression tests:

- \`link_bins_propagates_target_chmod_error_via_di\` — \`PermissionDenied\`
  must surface as \`Chmod\`.
- \`link_bins_swallows_target_chmod_not_found_via_di\` — \`NotFound\`
  must remain swallowed.

#5 (package-manager — peer-resolved slot name parsing): \`find_slot_
own_package_dir\` used \`slot_name.rfind('@')\` to strip the version
tail. That works for \`parent@1.0.0\` and \`@scope+parent@1.0.0\` but
breaks for peer-resolved slots: \`to_virtual_store_name\` produces
shapes like \`ts-node@10.9.1_@types+node@18.7.19_typescript@5.1.6\`
where the last \`@\` is inside a peer's version, not at the
package-name boundary. \`rfind\` then split inside the peer spec, the
slot's own package wasn't found, and the slot was silently skipped —
bins of children of every peer-resolved slot were never linked.

Parse from the left instead, skipping a single leading \`@\` that
belongs to a scoped package. The package-name half can never contain
\`@\` after \`to_virtual_store_name\`'s scope normalization (\`/\` →
\`+\`), so the first non-leading \`@\` is the right boundary. Adds
\`link_virtual_store_bins_handles_peer_resolved_slot_name\` using the
exact \`ts-node@10.9.1_@types+node@18.7.19_typescript@5.1.6\` shape
verified by \`pacquet_lockfile::pkg_name_ver_peer::tests::to_virtual_
store_name\`.

Both fixes verified by re-breaking the relevant code path and
confirming the regression tests fail, then reverting.

Drive-by from #9 (style nit on the chain split in
\`SymlinkDirectDependencies::run\`): the chain was broken in the
earlier \`feat(cmd-shim): port directories.bin discovery and Windows
shim formats\` commit (dfdd33a) because \`direct_deps\` is consumed
twice — once by \`symlink_direct_deps_into_node_modules\`, once by
\`link_direct_dep_bins\`'s \`dep_names\` derivation. That can't sit
inside a single chain. Documenting it here in lieu of amending the
earlier commit.

Test count: cmd-shim 70 → 72, package-manager (lib) 38 → 39.