…pm#11678)

* feat(pacquet/directory-fetcher,pacquet/package-manager): port directory fetcher for injected workspace deps

Port pnpm's `fetching/directory-fetcher` package as a new
`pacquet-directory-fetcher` crate and wire `LockfileResolution::Directory`
into `InstallPackageBySnapshot::run` so injected workspace deps
(`file:./local-pkg` + `dependenciesMeta[*].injected = true`) actually
install instead of returning `UnsupportedResolution`.

Mirrors upstream's
[`fetching/directory-fetcher/src/index.ts`](https://github.com/pnpm/pnpm/blob/85ceff2383/fetching/directory-fetcher/src/index.ts):

- `walk_all_files` ports `fetchAllFilesFromDir` — recursive walk,
  `node_modules` exclusion at any depth, broken-symlink ENOENT skip,
  `resolve_symlinks` toggle between `fileStat` (`fs::metadata`) and
  `realFileStat` (`symlink_metadata` + `canonicalize`).
- `walk_package_files` ports `fetchPackageFilesFromDir` — delegates
  to `pacquet_git_fetcher::packlist` for the npm-packlist filter,
  tolerates a missing manifest for the Bit-workspace shape upstream
  documents at L63-L66.
- `DirectoryFetcher::run` returns `files_map` / `manifest` /
  `requires_build`, matching upstream's `FetchResult` minus
  `local: true` (implicit at the call site) and `packageImportMethod`
  (encoded by which slot the install dispatcher writes to).

Install dispatch:

- `install_package_by_snapshot.rs` resolves `dir_resolution.directory`
  against the newly threaded `workspace_root` (upstream's
  `lockfileDir`), calls `DirectoryFetcher::run`, and hands the
  source-path `files_map` straight through as `cas_paths`. The
  existing `import_indexed_dir` / `link_file` path accepts arbitrary
  source paths so no CAFS write is needed — directory deps don't go
  through the store at all, matching upstream's
  `local: true, packageImportMethod: 'hardlink'` semantics.
- `create_virtual_store.rs`'s `snapshot_cache_key` now returns
  `Ok(None)` for directory resolutions: there's no warm-cache key
  to recover from (the source dir may have changed since last
  install), so every install re-walks. Matches upstream.

Deferred follow-ups (out of scope for this PR):

- `resolveSymlinksInInjectedDirs` / `includeOnlyPackageFiles`
  config-knob plumbing — the dispatch hard-codes the upstream
  defaults (`false` / `false`) from
  [`extendInstallOptions.ts:41`](https://github.com/pnpm/pnpm/blob/85ceff2383/installing/deps-installer/src/install/extendInstallOptions.ts#L41)
  for now.
- Injected-dep re-mirror pass — `hoisted_dep_graph.rs` already
  records `injection_targets_by_dep_path` for every directory-typed
  snapshot location, but the post-install mirror that rebuilds those
  copies is not implemented yet.
- `package.json5` / `package.yaml` manifest read — pacquet's
  `safe_read_package_json_from_dir` only handles `package.json`; the
  other two variants upstream's `safeReadProjectManifestOnly`
  supports are a parity gap that affects directory deps the same way
  it affects every other manifest read in pacquet.

---
Written by an agent (Claude Code, claude-opus-4-7).

* fix(pacquet/directory-fetcher,pacquet/package-manager): address CodeRabbit review on pnpm#11678

Three parity / hardening fixes flagged in the CodeRabbit review on PR
pnpm#11678:

1. **Carve out directory snapshots from the current-lockfile-skip
   gate** (`create_virtual_store.rs`). Directory-typed snapshots have
   `integrity() == None`; without the carve-out `integrity_equal`
   collapsed `None == None == true` and the skip filter dropped the
   snapshot whenever a slot for it existed on disk, so a second
   install never re-walked the (mutable) source dir. Mirrors pnpm's
   `!isDirectoryDep` clause in `depIsPresent` at
   <https://github.com/pnpm/pnpm/blob/94240bc046/deps/graph-builder/src/lockfileToDepGraph.ts#L226-L228>.

2. **Add `DirectoryFetch` to `is_fetch_side_failure`**
   (`create_virtual_store.rs`). Upstream's catch at
   [`lockfileToDepGraph.ts:286-298`](https://github.com/pnpm/pnpm/blob/94240bc046/deps/graph-builder/src/lockfileToDepGraph.ts#L286-L298)
   wraps the whole `fetchPackage` dispatch, so directory-fetcher
   errors on optional snapshots are swallowed uniformly with tarball
   / git fetch errors. Without this, an optional injected-directory
   dep whose source was missing would hard-fail the install instead
   of being dropped.

3. **Symlink-cycle guard in `walk_all_inner`** (`directory-fetcher/
   src/walker.rs`). A `loop -> .` (or any ancestor-pointing) symlink
   previously sank the walker into infinite recursion until either
   ENAMETOOLONG or stack overflow fired. Skip-on-revisit keyed off
   `fs::canonicalize`, matching the pattern
   `pacquet_git_fetcher::packlist` already uses for
   `bundleDependencies` cycles. Pnpm's directory-fetcher has the same
   vulnerability; the guard is a defensible divergence because the
   positive-case behavior is identical to pnpm and the cycle case
   degrades from "crash" to "skip with a `tracing::warn`".

Added a regression test
(`walk_all_files_terminates_on_symlink_cycle`) that points a
`loop -> root` symlink at the walk root and asserts the cycle guard
short-circuits before any `loop/` descendant is recorded.

---
Written by an agent (Claude Code, claude-opus-4-7).

* style(pacquet/package-manager): trailing comma on multi-line matches! macro

Dylint's `perfectionist::macro-trailing-comma` lint flagged the
`matches!` invocation added in f2db87c. Add the trailing comma to
clear the lint.

CI: https://github.com/pnpm/pnpm/actions/runs/25958605314/job/76309781526

---
Written by an agent (Claude Code, claude-opus-4-7).