… DI seam

Replaces process-environment mutation in the `default_store_dir` tests with
the dependency-injection pattern established in pnpm/pacquet#339 and
consolidated for the in-tree pacquet subtree in #11708. Tracks
pnpm/pacquet#343 — the original issue still applied after pacquet was
merged into this repo because the env-mutating tests came with it.

The four affected unit tests (`test_default_store_dir_with_pnpm_home_env`
and `test_default_store_dir_with_xdg_env` in `defaults::tests`, plus
`should_use_pnpm_home_env_var` and `should_use_xdg_data_home_env_var` in
`lib::tests`) now drive each branch with per-test unit structs that
satisfy `EnvVar`. No `EnvGuard` snapshot, no `unsafe` block, no
process-environment write. The `home_dir` and `current_dir` closures call
`unreachable!` for branches the early `PNPM_HOME` / `XDG_DATA_HOME`
returns short-circuit before consulting them, documenting the
precondition the way the style guide's worked example does.

`default_store_dir` is now generic over `Sys: EnvVar` and takes the
`home_dir` and `current_dir` lookups as `FnOnce` closures, mirroring the
shape of `Config::current`. A thin args-less wrapper
`default_store_dir_host` wires the production `Host` provider together
with `home::home_dir` and `env::current_dir` so the SmartDefault
expression on `Config::store_dir` stays short. The `have_default_values`
wiring assertion now compares against
`default_store_dir::<Host>(home::home_dir, env::current_dir)` instead of
the old args-less helper.

`npmrc_auth::tests::ignores_non_auth_keys` no longer needs to hold the
EnvGuard global lock against the two `Config::new()` snapshots it
compares — nothing in the crate mutates `PNPM_HOME` or `XDG_DATA_HOME`
anymore, so the env-derived `store_dir` is observed identically by both
calls even under nextest's in-process parallelism.

`EnvGuard` itself stays in `pacquet-testing-utils` because the proxy
cascade and `NPM_CONFIG_WORKSPACE_DIR` tests in `lib::tests`, as well as
out-of-crate users in `git-fetcher` and `executor`, still rely on it.
Retiring it entirely is out of scope for this issue.

---
Written by an agent (Claude Code, claude-opus-4-7).

…ameter

The Windows branch of `default_store_dir` calls
`current_dir().expect("current directory is unavailable")`, which
requires `Error: Debug` on the `Result<PathBuf, Error>` returned by the
`CurrentDir` closure. The original `where` clause didn't declare that
bound, so the function compiled on Linux/macOS (where the Windows
branch is `#[cfg(windows)]`-gated out) but failed on
`Lint and Test (windows-latest)` once the cfg fired.

All current callers pass `env::current_dir` (Error = `io::Error`) or
pin `Error = std::io::Error` via turbofish on test fakes — both
already satisfy `Debug` — so this is a pure type-bound fix with no
behaviour or call-site change.

---
Written by an agent (Claude Code, claude-opus-4-7).

Reviewer pointed out that the args-less `default_store_dir_host`
wrapper could be inlined into the `#[default(_code = ...)]`
expression on `Config::store_dir` — the SmartDefault macro accepts
the turbofish form `default_store_dir::<Host, _, _, _>(home::home_dir,
env::current_dir)` verbatim, and once the wrapper is gone there's
nothing for the indirection to earn.

Dropping the wrapper also removes a small motivation for the
`Host` import inside `defaults.rs` — adjust the doc comment on
`default_store_dir` to cite `crate::Host` by full path instead.

The `#[cfg(windows)] Error: std::fmt::Debug` bound that the same
reviewer asked about is not feasible: attributes on where-clause
predicates are still unstable (rust-lang/rust#115590), so the bound
stays unconditional with a comment explaining why.

---
Written by an agent (Claude Code, claude-opus-4-7).

Commit 49c690c inlined the SmartDefault expression for
`Config::store_dir` and dropped the `default_store_dir_host`
wrapper, but three comments still pointed at the wrapper or at the
old single-type-parameter signature of `default_store_dir`.
CodeRabbit and Copilot flagged all three on review:

- `crates/config/src/lib.rs`, `have_default_values`: the comment said
  the SmartDefault resolved "via the thin `default_store_dir_host`
  wrapper". Now reflects the direct
  `default_store_dir::<Host, _, _, _>(home::home_dir,
  env::current_dir)` call.
- `crates/config/src/npmrc_auth/tests.rs`, `ignores_non_auth_keys`:
  the comment cited `default_store_dir::<Host>` with no closure
  parameters. Now spells out the four-parameter turbofish that
  matches the current signature.
- `CODE_STYLE_GUIDE.md`, "Reading process state": the paragraph
  recommended an args-less `default_store_dir_host` wrapper as the
  pattern to follow. Now recommends inlining the production
  composition at the `SmartDefault` site directly.

Copilot also queried whether `#11718` was the right number
in the DI section's `EnvGuard` retirement citation — confirmed it
is. #11708 introduced the DI seam consolidation; this PR is the
one that retires the env-mutation pattern from `default_store_dir`.

---
Written by an agent (Claude Code, claude-opus-4-7).