Add an opt-in pnpm agent server that resolves dependencies server-side
and streams only the files missing from the client's store.

Server (@pnpm/agent.server):
- Multi-process HTTP server (Node.js cluster, 9 workers)
- SQLite-backed metadata cache — resolution in ~1s vs ~3.4s with .jsonl
- Streaming NDJSON /v1/install — file digests emitted as packages resolve
- Gzip-compressed streaming /v1/files — no buffering on server or worker
- Binary protocol with server-provided digests (no client rehashing)

Client (@pnpm/agent.client):
- Streaming NDJSON parser dispatches worker batches during resolution
- Worker-thread streaming HTTP + gzip decompress + CAFS writes
- Pre-packed msgpack store index entries written directly to SQLite
- Pipelined headless install via wrapped store controller

Config: `agent: "http://host:port"` in pnpm-workspace.yaml

- Delete dead binary-protocol code (`encodeResponse`, `decodeResponse`)
  and related types — the agent uses NDJSON + gzip-streamed /v1/files now
- Remove unused `port` option from `RegistryServerOptions`
- Delay `writeHead(200)` until after JSON parsing on /v1/install and
  /v1/files so parse failures return a 400 with a JSON error body
- On late failures, emit `E`-line NDJSON instead of a bogus JSON body
- Use real `computeDiff` stats in the final `L` line
- Validate sha512 digests on /v1/files before trusting them in binary
  headers (rejects invalid hex with 400)
- Normalize agent base URL with trailing `/` + relative paths so path
  prefixes are preserved (client + worker)
- Client: handle server-emitted `E` lines and reject on unexpected
  stream end without a lockfile
- Worker: reject non-2xx /v1/files responses; fail if the stream ends
  without the 64-byte end marker or leaves unparsed bytes
- Worker: validate `setImportConcurrency` input (positive integer)
- Close `realServer` and clean up tmp dir in pnpmRegistry e2e afterAll
- Update agent server and client READMEs (config key `agent`,
  NDJSON+gzip protocol)

- Reject YAML-unsafe characters (control chars, quotes, backtick,
  backslash) in `project.dir` on /v1/install; a crafted dir could
  otherwise break out of the single-quoted scalar emitted into
  pnpm-workspace.yaml
- Close the agent-install StoreIndex in a finally so a failing
  fetchFromPnpmRegistry doesn't leak a SQLite handle (on Windows
  that also blocks store cleanup)
- Validate /v1/files stream entries against the set of digests the
  worker actually requested — a misbehaving agent can't stream extra
  or unrelated entries and write unbounded files into CAFS
- Wrap the /v1/files stream's `processBuffer()` in try/catch so
  write/mkdir errors reject the worker Promise instead of surfacing
  as uncaughtException and crashing the worker thread
- Retry `StoreIndex.checkpoint()` under SQLITE_BUSY for consistency
  with the rest of the DB ops in this file
- Counting proxy in pnpmRegistry e2e test now guards undefined
  `req.url` and handles `proxyReq` errors with a 502 response

- Close `opts.storeController` in the agent install path's finally so
  pending StoreIndex writes are flushed on both success and failure,
  matching the normal install lifecycle
- Reject non-array `digests` in /v1/files with a 400 before the
  iteration so a malformed request body can't reach the stream loop
- Normalize workspace project `dir` to POSIX separators on the client
  — `path.relative()` returns backslashes on Windows which the agent
  server now rejects as unsafe YAML characters
- Worker /v1/files stream now fails if the server ended cleanly but
  omitted any requested digest (tracked via `requestedDigests`);
  previously this silently succeeded and left the CAFS incomplete

- Filter `readStoreIntegrities()` to actual SRI prefixes (sha512-,
  sha256-, sha1-) so non-integrity StoreIndex keys (e.g. git-hosted
  entries) aren't sent over to the agent server
- Worker /v1/files: when EEXIST hits an existing CAFS file, verify
  the on-disk size matches the received content and atomically
  rewrite if it doesn't — guards against truncated files left by a
  crashed previous process (which would otherwise be silently
  trusted by the agent path that skips integrity verification)
- `setImportConcurrency` disposers now restore only when their own
  limiter is still active, so overlapping installs in the same
  process don't clobber each other's overrides
- Plumb real `InstallationResultStats` from `headlessInstall()` out
  of the agent install path; `mutateModules` now returns those
  instead of all-zeros + a non-existent `updated` field

Reading d.digest/d.executable on a null or malformed entry would throw
and surface as a 500 after headers may have been written. Now each
entry is validated (must be an object with a valid sha512 hex digest
and boolean executable) and any mismatch is rejected with a 400.

Drop the workspace-internal name and dotted suffix in favor of an
unscoped name that doubles as the bin name. Set initial version
0.0.1-0 and remove `private: true` so it can be published.

- Update workspace consumers (pnpm CLI, agent/server tests, e2e
  test) to import from 'pnpm-agent'.
- Update @pnpm/agent.client README JSDoc reference.
- Add 'pnpm-agent' to the meta-updater's with-registry preset list
  so its tests still get the registry-mock setup.
- Add agent/server/Dockerfile that installs pnpm-agent globally via
  pnpm and runs it. Image only works once pnpm-agent is published
  to npm.

Swap node:22-slim + corepack for the official pnpm base image. Node
is now installed inside the container via `pnpm runtime set node 22
-g`, matching the intended flow of the GHCR image (which ships pnpm
but no Node runtime).

Drops the manual PNPM_HOME/PATH setup — the base image already sets
PNPM_HOME=/pnpm and puts /pnpm/bin on PATH, so both `node` and
`pnpm-agent` are resolved out of the same global bin dir.