Ports pnpm's pickPackageFromMeta and pickPackage from
resolving/npm-resolver/src/ — the pure version-picking surface and
the cache+fetch orchestration that wraps it. Plugs into the Stage 2
resolver scaffolding so the chain's npm leg can resolve a registry
spec to a concrete (name, version, manifest) triple.

Two new modules under `crates/resolving-npm-resolver/src/`:

- `pick_package_from_meta` — the pure picker. Ports
  [`pickPackageFromMeta`](https://github.com/pnpm/pnpm/blob/f657b5cb44/resolving/npm-resolver/src/pickPackageFromMeta.ts),
  `pickVersionByVersionRange` (with the deprecated-version fallback),
  `pickLowestVersionByVersionRange`, `filterPkgMetadataByPublishDate`
  (the `minimumReleaseAge` filter), the
  `PreferredVersionsPrioritizer` group-by-weight logic, and the
  error codes upstream surfaces (`ERR_PNPM_UNPUBLISHED_PKG`,
  `ERR_PNPM_NO_VERSIONS`, `ERR_PNPM_MISSING_TIME`). Introduces
  `RegistryPackageSpec` / `RegistryPackageSpecType` as the picker's
  input shape; the parser that produces these is its own port.

- `pick_package` — the cache+fetch orchestration. Ports
  [`pickPackage`](https://github.com/pnpm/pnpm/blob/f657b5cb44/resolving/npm-resolver/src/pickPackage.ts)
  with all four pre-fetch layers (in-memory `PackageMetaCache`,
  offline / preferOffline / pickLowestVersion disk read, version-spec
  fast path, publishedBy mtime shortcut), the 304-aware fetch via
  `fetch_full_metadata_cached`, the `include_latest_tag` runner that
  picks `max(spec, latest)`, the publishedBy-active fall-back-to-
  lowest path (`pickRespectingMinReleaseAge`), and the warn-and-skip
  `ignore_missing_time_field` path. Exposes `PackageMetaCache` as a
  trait with an `InMemoryPackageMetaCache` default impl plus a
  `shared_in_memory_cache()` factory.

Supporting changes:

- `pacquet_registry::PackageVersion` gained
  `deprecated: Option<String>` (the deprecated-fallback in
  pickVersionByVersionRange needs it; the field was missing).
- `pacquet_registry::Package` gained `dist_tag(tag)` / `dist_tags()`
  accessors, and `dist_tags` is now `pub` so the publishedBy filter
  can rebuild a packument with rewritten tags.

Documented divergences from upstream:

- Pacquet's metadata fetcher returns full metadata only; the
  abbreviated→full upgrade branches are in place but never fire
  today. Adding an abbreviated fetcher later is a drop-in.
- `dry_run` skips the in-memory cache write but the underlying
  fetcher still warms the on-disk mirror. Restoring upstream's
  "no disk side effects on dry-run" needs the fetcher to grow a
  write-bypass flag.
- Upstream's `p-limit(1)` per-mirror serialization is omitted; the
  atomic rename in `save_meta` covers write safety.

Tests: 21 new picker tests + 30 new orchestration tests
(mockito-backed). Full workspace nextest run passes (1547 tests).

Part of #11633 Stage 2 — npm resolver.

CI's `Doc` job (`RUSTDOCFLAGS="-D warnings"`) and `Dylint` job
(`-D perfectionist::derive-ordering`) caught issues missed by
`just ready`'s default profile:

- Disambiguate two-meaning intra-doc links the `Doc` job rejected as
  ambiguous: `fetch_full_metadata_cached()` (function vs module) and
  `crate::pick_package()` (function vs module).
- Qualify two unresolved links: `MissingTime` →
  `PickPackageFromMetaError::MissingTime`, and `LockfileResolution` →
  `pacquet_lockfile::LockfileResolution` in the resolver-base lib
  docs.
- Reorder four `#[derive(...)]` lists in
  `resolving-resolver-base/src/resolve.rs` so `Default` sits next to
  `Debug` in the prefix block (the `prefix_then_alphabetical`
  Perfectionist rule the `Dylint` job enforces). `Debug, Clone,
  Default, …` → `Debug, Default, Clone, …` and similar.

CI's `Dylint` job runs additional Perfectionist lints that
`just lint` (stable clippy) doesn't see. Fixing the leftover
violations:

- `single-letter-generic`: rename single-letter type parameters that
  don't carry meaning by themselves. `C: PackageMetaCache` →
  `Cache: PackageMetaCache`, the picker-fn `F` →
  `PickFn` / `PickOne`, the `AsRef<str>` versions slice `S` →
  `Raw`.
- `single-letter-generic` (parameter form): rename `a` / `b` in
  `pick_max` to `lhs` / `rhs`.
- `arc-clone-not-direct`: swap `meta.mutex.clone()` for
  `Arc::clone(&meta.mutex)` so the refcount bump is visible at the
  call site (matches the project style guide).
- `unicode-ellipsis-in-comments`: replace `…` with `...` in the
  default-resolver test that landed in the scaffold commit.
- `prefer-raw-string`: rewrite four `"\"…\" isn't supported…"`
  literals in the default-resolver tests as `r#""…" isn't…"#` raw
  strings.

CI's `Format` job (`cargo fmt --check`) and `Dylint` job
(`-D perfectionist::trailing-comma-in-single-line-macro`) caught two
spots where a multi-line `assert!` / `assert_eq!` collapsed to a
single line during the last fmt pass and kept its trailing comma.
Drop the trailing comma so both checks are happy.

…param

Dylint's `perfectionist::single-letter-generic` rule also catches
single-letter closure parameters. `|c|` in `is_url_friendly` →
`|ch|` so the rule passes.

Address review comments on #11755:

- **Cache parsed `Range` values** (Copilot). `semver_satisfies_loose`,
  `max_satisfying`, `min_satisfying` reparse `Range` on every call;
  in hot loops like `prioritize_preferred_versions` that's O(n)
  repeated parse work per packument. Mirror upstream's
  `semverRangeCache` with a process-global `DashMap<String,
  Option<Arc<Range>>>` so each range string is parsed at most once
  per process.

- **Recover from mutex poisoning** in `InMemoryPackageMetaCache`
  (Copilot). Other pacquet code (e.g. `build_modules.rs`) already
  uses `unwrap_or_else(|err| err.into_inner())` — the cache is a
  plain `HashMap` of cloneable values, so no broken invariants
  outlive a poisoned lock. Swap `.expect(...)` for the recovery
  pattern. Same for the `warn_missing_time_once` set.

- **Use `IndexSet` for the missing-time warning set** (Copilot).
  Replaces `Vec<String>` membership scan + `Vec::remove(0)`
  eviction with O(1) `contains` and O(n)-but-cheap-shift
  `shift_remove_index(0)`. Insertion order is preserved (matching
  upstream's JS `Set` iteration order), and the cap stays at 1024.

- **Scope the in-memory cache key by registry** (coderabbit). The
  same package name in two registries (private + public, scoped
  override, etc.) was colliding on `spec.name` alone; a packument
  fetched against one registry could short-circuit a later resolve
  against a different registry, returning the wrong metadata. Switch
  to `<registry>\x00<name>` cache keys. Adds
  `in_memory_cache_does_not_leak_across_registries` as a regression
  test pinning the new shape.

Two coderabbit suggestions deliberately not applied — both would
diverge from upstream pnpm:

- `<` vs `<=` in the `modified` shortcut: upstream pnpm uses strict
  `<` ([pickPackage.ts](https://github.com/pnpm/pnpm/blob/f657b5cb44/resolving/npm-resolver/src/pickPackage.ts#L372)
  and [pickPackageFromMeta.ts](https://github.com/pnpm/pnpm/blob/f657b5cb44/resolving/npm-resolver/src/pickPackageFromMeta.ts#L47))
  to keep the modified-shortcut conservative — if `modified == cutoff`,
  a version published exactly at the cutoff might exist and the
  fast path can't be taken. The per-version filter (`<=`) is a
  separate concern.

- Returning the picker's `None` on a fetch failure with a stale
  mirror: upstream pnpm explicitly returns
  `pickMatchingVersionFinal(...)`'s result verbatim in the
  fetch-error catch block ([pickPackage.ts](https://github.com/pnpm/pnpm/blob/f657b5cb44/resolving/npm-resolver/src/pickPackage.ts#L420-L431)),
  including when it's `null`. Re-throwing the fetch error would
  diverge from upstream's "swallow + serve stale" semantics.

The `minimumReleaseAge` shortcut on abbreviated metadata used strict
`<` against the cutoff (and equivalently `>=` to reject), so a
packument whose package-level `modified` equalled the cutoff fell
off the fast path. That's an unnecessary divergence from the
per-version filter in `filterPkgMetadataByPublishDate`, which uses
inclusive `<=` to treat a version published exactly at the cutoff
as mature.

Since `modified` is an upper bound on every version's publish time,
`modified == publishedBy` already implies every version passes the
per-version `<=` filter. The shortcut can now accept the boundary
case directly instead of triggering a full-metadata re-fetch (or a
`MISSING_TIME` error when full metadata isn't permitted).

Lands in both stacks under the parity rule in pacquet's AGENTS.md:

- **TypeScript pnpm** — `resolving/npm-resolver/src/pickPackage.ts`
  (`maybeUpgradeAbbreviatedMetaForReleaseAge`, and the in-band
  upgrade branch) and `resolving/npm-resolver/src/pickPackageFromMeta.ts`
  (the abbreviated `assertMetaHasTime` gate). Each call site flips
  `>=` to `>` (or `<` to `<=`) and adds a comment pinning the
  rationale.

- **Pacquet** — `pacquet/crates/resolving-npm-resolver/src/pick_package_from_meta.rs`
  flips `<` to `<=` in the abbreviated branch.

Tests:

- New `pick_from_meta_modified_shortcut_inclusive_at_cutoff` in
  pacquet (verified to catch the regression by reverting the
  comparison locally — the test fails, then passes when restored).
- New "use abbreviated metadata when modified date equals
  publishedBy" in `publishedBy.test.ts` upstream.

Changeset bumps `@pnpm/resolving.npm-resolver` and `pnpm` patch.

Addresses review feedback from coderabbit on #11755.

- `cached_range`: use `entry.value().clone()` to make the
  `dashmap::Ref` → `Option<Arc<Range>>` projection explicit, with a
  comment explaining the auto-deref + Clone the previous form was
  relying on. No behavior change.

- `WantedDependency` doc: clarify that `Default` is only kept so call
  sites can use the `..WantedDependency::default()` spread syntax;
  the at-least-one-of-(alias, bare_specifier) invariant is upheld by
  construction sites, not by the type system, and resolvers walking
  an empty WantedDependency should return `Ok(None)` to let the
  chain fall through to the SpecNotSupported terminal.