Two pre-existing perfectionist findings landed via #11526 and broke
the Dylint CI job on main:

- `perfectionist::macro-trailing-comma` flagged a trailing comma in a
  single-line `assert_eq!(...)` that `cargo fmt` had collapsed from a
  multi-line form without dropping the comma. Removed the comma.
- `perfectionist::unicode_ellipsis_in_comments` warned about a U+2026
  `…` character in a test comment. CI runs with `RUSTFLAGS=-D warnings`,
  so the warning fails the build. Replaced with ASCII `...`.

Verified locally with `cargo dylint --all -- --all-targets --workspace`
under `RUSTFLAGS=-D warnings`; passes clean.

---
Written by an agent (Claude Code, claude-opus-4-7).

…ues (pnpm#11526)

Closes pnpm#11513.

`actions/setup-node` writes `_authToken=${NODE_AUTH_TOKEN}` to `.npmrc`. When the user relies on OIDC trusted publishing without setting `NODE_AUTH_TOKEN`, pnpm previously passed the literal placeholder through verbatim — so any time OIDC fallback failed, pnpm sent `Authorization: Bearer ${NODE_AUTH_TOKEN}` to the registry and the publish came back as a 404.

This worked in v10 because `pnpm publish` shelled out to `npm publish`, whose own OIDC flow handled the case.

The fix lives in `@pnpm/config.env-replace@4.1.0`, which adds an `envReplaceLossy` variant that returns `{ value, unresolved }` instead of throwing. Unresolved `${VAR}` placeholders become `''` and are reported back as a list — leaving OIDC trusted publishing as the sole auth source. Resolvable placeholders and `${VAR-default}` / `${VAR:-default}` fallbacks elsewhere in the same string still expand normally, so a value like `pre-${SET}-mid-${UNSET}-${OTHER-default}-post` now produces `pre-AAA-mid--default-post` rather than dropping every placeholder.

Also treats `{ KEY: undefined }` in the env object the same as a missing key (the `Record<string, string | undefined>` contract), so a `${KEY-default}` reaches the fallback in that case.

### Changes

- `@pnpm/config.env-replace` catalog bumped from `^3.0.2` → `^4.1.0` (`pnpm-workspace.yaml`, `pnpm-lock.yaml`)
- `config/reader/src/loadNpmrcFiles.ts` — `substituteEnv` now calls `envReplaceLossy` and pushes one warning per unresolved placeholder
- `config/reader/test/index.ts` + `parseCreds.test.ts` — regression tests covering the OIDC case, mixed resolvable/unresolved placeholders, explicit-undefined env values, and `parseCreds({ authToken: '' })`
- `.changeset/oidc-unresolved-env-placeholder.md` — patch bump for `@pnpm/config.reader` and `pnpm`
- `pacquet/crates/config/{env_replace.rs, npmrc_auth.rs, npmrc_auth/tests.rs}` — mirrors the lossy semantics in pacquet's local `env_replace_lossy`, with matching test coverage

Two pre-existing perfectionist findings landed via pnpm#11526 and broke
the Dylint CI job on main:

- `perfectionist::macro-trailing-comma` flagged a trailing comma in a
  single-line `assert_eq!(...)` that `cargo fmt` had collapsed from a
  multi-line form without dropping the comma. Removed the comma.
- `perfectionist::unicode_ellipsis_in_comments` warned about a U+2026
  `…` character in a test comment. CI runs with `RUSTFLAGS=-D warnings`,
  so the warning fails the build. Replaced with ASCII `...`.

Verified locally with `cargo dylint --all -- --all-targets --workspace`
under `RUSTFLAGS=-D warnings`; passes clean.

---
Written by an agent (Claude Code, claude-opus-4-7).

…cause of rc.2 404s)

Root cause: actions/setup-node's `registry-url:` parameter writes
`//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}` to `.npmrc`.
When NODE_AUTH_TOKEN is unset (which it is, since we use OIDC Trusted
Publishing instead of a token), pnpm ≤9.x passes the literal
`${NODE_AUTH_TOKEN}` placeholder through verbatim — registry returns
404 (npm's masked auth-failure response) BEFORE OIDC fallback fires.

This is the bug pnpm/pnpm#11513 documents — fixed in pnpm 11.0.9+ via
PR pnpm/pnpm#11526 (drops unresolved ${VAR} placeholders to empty
string + warns). Not backported to 9.x. pnpm 10 works because
`pnpm publish` shelled out to `npm publish` whose own OIDC flow
handled the case; pnpm 9 + 11 implement OIDC natively and need the
fix.

The surgical workaround: don't have setup-node write the broken
`.npmrc` in the first place. `registry-url:` exists to authenticate
via NODE_AUTH_TOKEN — for OIDC-only publishing it's pure liability.
Dropping it means no placeholder for pnpm to mis-handle; OIDC's
ACTIONS_ID_TOKEN_REQUEST_TOKEN env path engages cleanly.

pnpm publish still targets registry.npmjs.org by default (workspace
+ scope config resolve there). Only loss is the auto-written `.npmrc`
auth line — which we explicitly don't want anyway.

Did NOT touch the other two registry-url uses in this file
(preflight's collision check + smoke's install) — those are
anonymous-OK operations that work fine with or without the broken
`.npmrc`. Will revisit only if smoke surfaces an issue.

Fixes the rc.2 publish failures observed across multiple retries
during this session.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>