Adds pacquet-resolving-resolver-base, a small crate holding the
ResolutionVerifier trait, ResolutionVerification enum, and
ResolutionPolicyViolation struct ported from
@pnpm/resolving.resolver-base. The trait + violation type live in
their own crate (not in the verification runner) so future verifier
crates - npm today, custom resolvers tomorrow - can depend on the
trait without pulling in the runner, matching upstream's layering.

verify() returns a hand-rolled Pin<Box<dyn Future + Send + '_>> so
the trait stays dyn-compatible without an async-trait dep; the
runner stores its verifier list as &[Box<dyn ResolutionVerifier>]
to fan out across a heterogeneous set.

Phase 1 of #11722.

The lockfile-verification gate (#11722) needs RFC3339
date parsing for the npm verifier's release-age and trust-policy
checks. chrono is already in the workspace as a dev-dep; this
moves the same entry into [workspace.dependencies] so the
forthcoming pacquet-resolving-npm-resolver crate can depend on it
without a new third-party crate selection.

No production code consumes chrono yet; the runtime dep slot is
added under the rule that new third-party deps need explicit
approval (which the user gave in the planning round for #11722).

Ports the seven config keys the upstream lockfile-verification gate
reads from pnpm-workspace.yaml plus the cacheDir field they share:

- cacheDir (default resolved per upstream getCacheDir's XDG /
  platform / LOCALAPPDATA chain)
- minimumReleaseAge, minimumReleaseAgeExclude,
  minimumReleaseAgeIgnoreMissingTime, minimumReleaseAgeStrict
- trustPolicy (new TrustPolicy enum: off | no-downgrade)
- trustPolicyExclude, trustPolicyIgnoreAfter

Also moves the version-policy parser into pacquet-config and adds
the matcher-based createPackageVersionPolicy companion to the
already-ported expandPackageVersionSpecs. The matcher variant is
what minimumReleaseAgeExclude and trustPolicyExclude evaluate
against: wildcard name patterns (is-*, @scope/*) plus exact-version
unions (lodash@4.17.21 || 4.17.22). expandPackageVersionSpecs
keeps its callers via a re-export shim in pacquet-package-manager.

Phase 2 of #11722.

…ions

Extends Package, PackageVersion, and PackageDistribution with the
fields the lockfile-verification verifier consults:

- Package gains `time` (per-version publish timestamps,
  HashMap<String, serde_json::Value> so the reserved `unpublished`
  object key round-trips alongside the version-keyed strings),
  `modified` (abbreviated-metadata last-modified shortcut), and
  `etag` (kept for Phase 5's conditional-GET fetcher).
- PackageVersion gains `_npmUser.trustedPublisher` via a new
  NpmUser + TrustedPublisher type pair.
- PackageDistribution gains `attestations.provenance` via new
  AttestationsDist + ProvenanceMeta types.

A small Package::published_at helper resolves the per-version
lookup while filtering the reserved `unpublished` object value
that lives in the same map.

Four new fixture-based deserialize tests pin the wire shapes:
full-provenance packument, no-_npmUser / no-attestations
fallback, missing time field, and the `unpublished` reserved-key
skip. Existing PackageVersion / Package construction sites in
tests fill the new fields explicitly so the breaking field
additions don't ripple into runtime callers (which don't build
these structs by hand).

Phase 3 of #11722.

…registry

Creates the new pacquet-resolving-npm-resolver crate and lands its
network-side helpers ahead of the verifier itself:

- violation_codes: MINIMUM_RELEASE_AGE_VIOLATION + TRUST_DOWNGRADE
  consts (verbatim from upstream).
- named_registry: BUILTIN_NAMED_REGISTRIES (`gh:` builtin) +
  build_named_registry_prefixes (longest-first sorted, trailing-slash
  normalized) + pick_registry_for_version (tarball-URL match first,
  scope-routing fallback).
- fetch_full_metadata: no-cache `Accept: application/json` fetch
  targeting the full-metadata endpoint so `time`, `_npmUser`, and
  `dist.attestations` come back populated. Cached variant lands in
  Phase 5.
- fetch_attestation_published_at: port of upstream's Sigstore-bundle
  parser hitting `/-/npm/v1/attestations/<name>@<version>`; earliest
  Rekor `integratedTime` wins; non-2xx, malformed body, network
  errors all collapse to `Ok(None)` so the verifier falls through to
  the next layer.
- errors: FetchMetadataError::Network for the underlying reqwest
  failures the verifier folds into violation reasons.

15 mockito-driven unit tests pin the wire contracts: auth-header
attachment, full-vs-abbreviated endpoint targeting, 404/5xx/
malformed-body fall-through, earliest-bundle selection, the
`integratedTime` string-or-number defensive parse, trailing-slash
trim on the registry root, longest-first prefix ordering, and the
near-miss URL rejection on the named-registry router.

The verifier (create_npm_resolution_verifier) and trust_checks land
in follow-up commits this phase.

Phase 4 (slice 1 of 2) of #11722.

Adds trust_checks.rs — the rank-based supply-chain-evidence walk
that decides whether a lockfile version's `_npmUser.trustedPublisher`
or `dist.attestations.provenance` is weaker than the strongest
evidence seen on any earlier-published version of the same
package.

- TrustEvidence enum (Provenance < TrustedPublisher).
- TrustViolation with TrustDowngrade + TrustCheckFailed variants
  mirroring upstream's PnpmError codes.
- TrustCheckOptions threads trustPolicyExclude (a PackageVersionPolicy
  built in Phase 2), trustPolicyIgnoreAfter (minutes cutoff),
  and an injectable `now` for deterministic ignore-after tests.
- fail_if_trust_downgraded ports the upstream control flow
  one-for-one: exclude-policy short-circuit, time + manifest
  lookups, the prerelease guard, history walk, rank compare.
- get_trust_evidence ports upstream's two-line accessor for
  reuse by future consumers.

14 fixture-based tests cover: first-version pass, trusted-publisher
→ provenance downgrade, provenance → unsigned downgrade,
equal-rank pass, rank upgrade, later-publish-doesn't-affect-
earlier, stable-target-ignores-prerelease-history, prerelease-
target-sees-prerelease-history, ignore-after-skips, ignore-after-
still-checks-fresh, exclude-any-version, exclude-exact-version,
missing-time TrustCheckFailed, unparseable-timestamp
TrustCheckFailed.

Phase 4 (slice 2 of 2 — main verifier next) of #11722.

Adds the `NpmResolutionVerifier` that re-applies `minimumReleaseAge`
and `trustPolicy='no-downgrade'` to every npm-registry-resolved
lockfile entry, plus the factory that returns `None` when no policy
is active. Implements the `ResolutionVerifier` trait from
`pacquet-resolving-resolver-base`: `verify` short-circuits on
non-registry resolutions and non-semver versions, dispatches the
age / trust checks, and surfaces violations through
`ResolutionVerification::Err` with the `MINIMUM_RELEASE_AGE_VIOLATION`
or `TRUST_DOWNGRADE` code. `policy()` returns the JSON snapshot the
verification cache hashes; `can_trust_past_check` accepts a looser
maturity cutoff but demands byte-exact match on every exclude list
and the trust policy.

The publish-timestamp lookup walks the attestation endpoint, then
the full packument. The abbreviated-modified shortcut and the
on-disk-mirror layer land in Phase 5 alongside the cached fetcher
they depend on; their slots in `PublishedAtLookupContext` will be
added at the same time.

Ports `createNpmResolutionVerifier.ts` from upstream pnpm at
`2a9bd897bf`.

Adds the on-disk packument mirror that pacquet shares with pnpm.
The verifier now consults a JSONL mirror at
`<cache_dir>/v11/metadata-full/<registry-slug>/<encoded-name>.jsonl`,
issues a conditional GET (If-None-Match / If-Modified-Since), and
either serves the cached body on 304 or writes the new body back on
200. Without `cache_dir` the call falls through to an unconditional
GET — same behavior as the no-cache fetcher.

The path / IO helpers (`encode_pkg_name`, `get_registry_name`,
`get_pkg_mirror_path`, `prepare_json_for_disk`, `load_meta_headers`,
`load_meta`, `save_meta`) and the `FULL_META_DIR` /
`ABBREVIATED_META_DIR` constants live in a new `mirror` module so
the abbreviated-cache fast path (and any future `pickPackage` work)
can reuse them. Constants and directory layout are byte-identical
to pnpm's so a mirror populated by one stack works for the other.

Two new error variants on `FetchMetadataError` mirror upstream's
codes: `META_NOT_MODIFIED_WITHOUT_CACHE` and
`META_CACHE_MISSING_AFTER_304`.

Wires `create_npm_resolution_verifier` to the cached fetcher with a
new `cache_dir: Option<PathBuf>` field on the options bag.

Ports `fetchFullMetadataCached.ts` and the cache helpers from
`pickPackage.ts` at upstream commit `2a9bd897bf`.

Adds the new `pacquet-lockfile-verification` crate that hosts the
fan-out gate pnpm runs immediately after loading a lockfile, before
any resolution decision or fetch. Walks every entry in
`lockfile.packages`, dedupes by `(name, version, resolution)`, and
asks every active `ResolutionVerifier` to evaluate each candidate.
Verifiers handle their own protocol short-circuit so the runner stays
policy-neutral.

This slice ports the runner-side surface only:

- `verify_lockfile_resolutions::<R: Reporter>` — throw-mode entry
  point. Concurrency-capped fan-out via tokio Semaphore +
  futures-util FuturesUnordered, sort + cap violations at 20,
  escalate to `LOCKFILE_RESOLUTION_VERIFICATION` on mixed-code
  batches. `Started` / `Done` / `Failed` reporter events pair via a
  drop guard so a panic can never leave a hanging "Verifying…" frame.
- `collect_resolution_policy_violations` — data-returning sibling
  for auto-collect / strict-prompt callers.
- `hash_lockfile` — sha256-hex content hash of the in-memory
  Lockfile. Normalises HashMap key order through a sorted serde_json
  value so two lockfiles that deserialise to the same shape hash the
  same. Hex output (not base64) — pacquet's cache reads its own
  records out of the shared JSONL; cross-stack hash compat isn't
  required for the cache contract.
- `VerifyError` — three diagnostic variants
  (`MINIMUM_RELEASE_AGE_VIOLATION`, `TRUST_DOWNGRADE`,
  `LOCKFILE_RESOLUTION_VERIFICATION`) carrying the rendered
  breakdown. Help text matches pnpm.

The on-disk JSONL cache (`tryLockfileVerificationCache` /
`recordVerification`) lands in a follow-up slice.

Ports `verifyLockfileResolutions.ts` at upstream commit `2a9bd897bf`.

Adds the on-disk cache that lets repeat installs against an
unchanged lockfile (under the same or stricter policy) skip the
per-package registry round-trips entirely.

Cache layout matches pnpm at `<cache_dir>/lockfile-verified.jsonl`,
one JSON record per line:

  { "lockfile": { "hash", "path", "size", "mtimeNs", "inode" },
    "verifiedAt": "...", "policy": { ... } }

Two indexes share the same records:

- **by content hash** — primary lookup. Catches the worktree /
  CI-checkout case where the same lockfile content lives at a
  different path.
- **by absolute path** — same-machine stat shortcut. When the
  cached entry's `(size, mtime_ns, inode)` matches the current
  stat, the cached hash is still correct and the gate skips
  reading the lockfile entirely.

Policy snapshot trust is verifier-driven: every active
`ResolutionVerifier::can_trust_past_check` must agree the cached
snapshot still covers what it currently demands; any rejection
falls through to the full gate.

Compaction kicks in when the file passes ~1.5 MB:

  reverse-walk → dedupe by (path, hash) → keep newest →
  trim to MAX_CACHE_ENTRIES (1000) → write to temp + rename.

Single-line appends are atomic on POSIX and NTFS so parallel pnpm
/ pacquet processes (monorepo installs, CI matrices sharing a
cache) can write without coordination.

`record_lockfile_verified` provides a thin wrapper for callers
that hold a freshly-written lockfile and want to mark it as
already-verified for the next install.

Wires the cache into `verify_lockfile_resolutions`:

- `cache_dir` + `lockfile_path` on the options bag activates it.
- Lookup runs before the verifier fan-out; a hit returns Ok
  without emitting Started/Done events.
- A miss reuses the precomputed stat + hash on the matching
  recordVerification call.
- Empty-candidate runs still record a success so the next install
  can stat-only the lockfile.

Ports `verifyLockfileResolutionsCache.ts` and
`recordLockfileVerified.ts` at upstream commit `2a9bd897bf`.

Adds the install-side wiring upstream pnpm has at
[`installing/deps-installer/src/install/index.ts:355-383`](https://github.com/pnpm/pnpm/blob/2a9bd897bf/installing/deps-installer/src/install/index.ts#L355-L383):
the gate runs immediately after `Lockfile::load_current_from_virtual_store_dir`
and before the `pnpm:context` emit, only when `lockfile.is_some()`.

Pipeline:

  Install::run
    └─ build_resolution_verifiers(&Config, Arc<ThrottledClient>)
       └─ create_npm_resolution_verifier(opts) -> Option<NpmResolutionVerifier>
    └─ verify_lockfile_resolutions::<Reporter>(lockfile, &verifiers, &opts)

When the user hasn't set `minimumReleaseAge` or `trustPolicy`, the
verifier list is empty and the runner short-circuits — zero overhead
on installs without policy.

New surface:

- `pacquet_package_manager::build_resolution_verifiers` — assembles
  the verifier list from `Config`. Maps `Config::registry` into the
  single-default `{"default": url}` map the npm verifier expects;
  `named_registries` stays empty pending the npmrc wiring for it.
- `InstallError::LockfileVerification(VerifyError)` — transparent
  miette diagnostic so the inner `MINIMUM_RELEASE_AGE_VIOLATION` /
  `TRUST_DOWNGRADE` / `LOCKFILE_RESOLUTION_VERIFICATION` code is
  what the user sees, matching pnpm byte-for-byte.
- `InstallError::BuildVerifiers(BuildVerifiersError)` — surfaces an
  invalid `minimumReleaseAgeExclude` / `trustPolicyExclude` pattern
  before the gate runs.

Plumbing:

- `Install` and `Add` gain `lockfile_path: Option<&'a Path>` and
  `http_client_arc: Arc<ThrottledClient>` fields. The CLI derives
  both from existing state — `lockfile_path` from `manifest.path()`'s
  parent (becomes `workspace_root` once workspace support lands),
  `http_client_arc` from a `State::http_client` field that's now
  held behind `Arc` so the verifier can own a clone.

Two new tests pin the user-visible contract for the gate wired in
the previous slice:

**install layer** (`pacquet-package-manager`):

- `install_rejects_invalid_minimum_release_age_exclude_pattern` —
  proves `build_resolution_verifiers` runs from inside
  `Install::run` by feeding it an invalid exclude pattern and
  asserting `InstallError::BuildVerifiers`. Sub-second; no registry
  round-trip.
- `frozen_lockfile_gate_rejects_under_huge_minimum_release_age` —
  positive-path proof that the verifier actually runs end-to-end.
  With `minimumReleaseAge` set to 100 years against the mocked
  registry, every lockfile entry trips the cutoff and the install
  fails with `InstallError::LockfileVerification(MinimumReleaseAgeViolation)`
  before any tarball is fetched.

**CLI layer** (`pacquet-cli`):

- New `tests/lockfile_verification.rs` spawning the actual binary
  via `CommandTempCwd`. Writes `pnpm-workspace.yaml` with the
  upstream-canonical `minimumReleaseAge` key, a pinning
  `pnpm-lock.yaml`, and a matching `package.json`. Asserts
  non-zero exit and that stderr contains the literal
  `MINIMUM_RELEASE_AGE_VIOLATION` so `pnpm errors` URL routing and
  log consumers both work.

Both layers verify the gate short-circuits before any virtual-store
materialization.

…shots

**TEST_PORTING.md.** New "Lockfile Verification Gate" section
enumerates every upstream test the gate work mirrored, with a
[x]/[ ] checkbox per item and the Rust-side test name. Covers:

- `trustChecks.test.ts` — 14 of 16 tests pinned in
  `pacquet-resolving-npm-resolver`'s `trust_checks::tests`.
- `fetchAttestationPublishedAt.test.ts` — 7 tests pinned in
  `fetch_attestation_published_at::tests`.
- `createNpmResolutionVerifier.test.ts` — 5 of 6 tests pinned;
  the abbreviated-shortcut case stays unchecked until that layer
  is ported.
- `fetchFullMetadataCached` — the four Phase 5 mockito scenarios.
- `verifyLockfileResolutions.ts` runner — 11 of 14 pinned; three
  dedupe / cache-write-on-failure cases still need explicit
  Rust-side tests.
- `verifyLockfileResolutionsCache.ts` — 7 of 14 pinned; the
  stat-shortcut size/mtime-drift variants and the multi-verifier
  merge happy-path are gaps.
- `recordLockfileVerified.ts` — wrapper guards covered; the
  load-equivalent-hash and git-branch lockfile cases are gaps.
- `minimumReleaseAge.ts` install-side — 3 of 8 pinned, plus
  Rust port notes flagging the resolver-dependent fall-back
  branches as out of scope until pacquet has a resolver.
- `config/version-policy/test/index.ts` — covered via the
  upstream version-policy port + the install-side
  `BuildVerifiersError` wrapper.

**Diagnostic snapshots.** Three new insta snapshots in
`errors::tests` pin the rendered Display text for the three
violation shapes a user actually sees:

- `single_entry_single_code` — one immature pin, per-policy code
  on the envelope.
- `three_entries_single_code` — three immature pins, single-column
  breakdown (no per-line code prefix).
- `three_entries_mixed_codes` — mixed batch, escalated envelope
  code, `[CODE]` prefix per line so each entry's policy is
  visible.

Mirrors upstream `PnpmError` Display shape byte-for-byte,
including the "1 lockfile entries" pluralization quirk in
`verifyLockfileResolutions.ts:195`.