Implements phases A, B, and C of #11756: ports `parseBareSpecifier`,
adds the `NpmResolver` struct implementing the `Resolver` trait, and
refactors the no-lockfile install into a two-pass resolve-then-install
shape backed by a minimum-slice port of `resolveDependencyTree`.
`InstallPackageFromRegistry` now takes a pre-resolved `ResolveResult`
instead of `(name, version_range)` and drops the legacy
`Package::fetch_from_registry` + `Package::pinned_version` calls — all
npm-shaped resolution flows through the new chain.

---
Written by an agent (Claude Code, claude-opus-4-7).

CI's Doc job runs `cargo doc --no-deps --workspace --document-private-items`
under `RUSTDOCFLAGS=-D warnings`; CI's Dylint job runs Perfectionist
lints under `-D warnings` too. Neither surfaces in `just ready`. Fix
the items the post-push run flagged:

* Disambiguate fn-vs-module rustdoc links with `name()` syntax.
* Resolve the `Resolver` link in `resolving-deps-resolver` against
  `pacquet_resolving_resolver_base::Resolver`.
* Reorder the `ResolvedTree` derives to `Debug, Default, Clone`.
* Rename the resolver-chain generic from `R` to `Chain` and the dist-
  tag validator's `s` to `selector`, matching the existing
  `Cache: PackageMetaCache` precedent.
* Add a trailing comma to the multi-line `assert!` body.

---
Written by an agent (Claude Code, claude-opus-4-7).

- install_without_lockfile: place the dedup gate after the
  per-edge `install_package_from_registry` call instead of
  before it, so a `(name, version)` reached from two different
  parents still produces the per-parent `node_modules/<alias>`
  symlink. Dedup now only short-circuits the children walk,
  matching the original install loop's semantics before the
  resolveDependencyTree refactor.
- npm_resolver: propagate `serde_json::to_value` errors as
  `ResolveError` instead of silently dropping the manifest.
- install_package_from_registry: use `usize::try_from` for the
  `unpackedSize` hint so a `u64` larger than the host `usize`
  on 32-bit targets degrades to `None` rather than truncating.
- parse_bare_specifier: anchor the tarball filename version
  extraction on the scopeless-name prefix so a registry that
  serves `<reg>/foo/-/bar-1.0.0.tgz` declines instead of being
  mapped to the wrong `(name, version)` pair. Tests cover the
  rejection.
- package-manager: drop the unused
  `pacquet-resolving-default-resolver` dependency.
  `DefaultResolver` isn't wired into install today because the
  chain has only one entry; routing through it now would surface
  `SPEC_NOT_SUPPORTED_BY_ANY_RESOLVER` for every non-npm
  specifier (git/file/etc) and regress installs whose
  per-protocol resolvers haven't been ported yet. Land DefaultResolver
  wiring alongside the second resolver impl.

---
Written by an agent (Claude Code, claude-opus-4-7).

After landing the dedup-after-symlink reordering, every parent→child
edge to a shared dep fired the per-package signals
(`pnpm:progress resolved`, `pnpm:progress imported`, plus the
`DownloadTarballToStore` events) once for each visit. That inflates the
reporter's per-package counts and breaks parity with pnpm, which fires
the resolved/imported channels exactly once per `(name, version)`.

Thread a `first_visit: bool` through `InstallPackageFromRegistry`:

* `first_visit == true` runs the full path — emit `resolved`,
  download + cache + import the tarball, emit `imported`, symlink
  the parent.
* `first_visit == false` only refreshes the per-parent symlink under
  `<node_modules_dir>/<alias>`. No progress emits, no redundant
  download/import.

`install_without_lockfile.rs` computes `first_visit` from the
`resolved_packages.insert(...)` return value and threads it in; the
same boolean still gates the children recursion below the call.

Adds `second_visit_skips_progress_emits_but_still_links` against the
mock registry to pin the contract: a future refactor that moves the
gate can't quietly reintroduce per-edge spam.

---
Written by an agent (Claude Code, claude-opus-4-7).

* npm_resolver: route registry picks via `(alias, bare_specifier)`
  so an npm-alias entry like `"foo": "npm:@acme/bar@^1"` resolves
  through `registries[@acme]` instead of the local alias's empty
  scope. Ports upstream's bareSpecifier-aware `pickRegistryForPackage`
  by extending pacquet's `pick_registry_for_package` to take an
  optional `bare_specifier` and consulting the `npm:@scope/...`
  form before falling back to the package name's scope. New tests
  cover the npm-alias scope override and the plain-name fallback.

* install_without_lockfile: gate the second-visitor symlink on the
  first writer's import completion. `ResolvedPackages` is now a
  `DashMap<String, watch::Sender<bool>>` instead of a bare
  `DashSet<String>`; the first visitor inserts a `watch` channel,
  runs the full materialization, and signals `true` afterwards.
  Concurrent second visitors subscribe to the slot and await the
  completion bit before issuing `symlink_package`, so a Windows
  `force_symlink_dir` fall-back to junction creation can't race
  ahead of the target directory's existence. A dropped first writer
  (panic / cancel) surfaces as `FirstWriterAborted` so the install
  fails closed.

* install_without_lockfile: thread `minimumReleaseAge` /
  `minimumReleaseAgeExclude` from `Config` into the resolver's
  `ResolveOptions`. The previous slice left both unset, so the
  resolver path silently ignored the policy even though the
  lockfile-verifier already enforced it. Compiles the exclude
  patterns via `pacquet_config::version_policy::create_package_version_policy`,
  matching `build_resolution_verifiers`'s plumbing. Surfaces parse
  errors as `MinimumReleaseAgeExclude` with code
  `ERR_PNPM_INVALID_MINIMUM_RELEASE_AGE_EXCLUDE`.

---
Written by an agent (Claude Code, claude-opus-4-7).

CodeRabbit flagged the local-scope fallback as a bug for
`"@private/foo": "npm:lodash@^1"`. The behavior actually matches
upstream's `getScope` at
<https://github.com/pnpm/pnpm/blob/2a9bd897bf/config/pick-registry-for-package/src/index.ts#L8-L19>:
the npm-alias branch only returns a scope when the alias target is
itself scoped (`npm:@scope/...`); otherwise it falls through to the
local pkgName's scope. The local alias slot is treated as the
authoritative signal of which registry the user wants to fetch from
(e.g. a private fork of an unscoped package re-published under
`@private/`).

Adds a regression test (`unscoped_npm_alias_under_scoped_local_name_keeps_local_scope`)
locking the upstream-matching behavior in so a future refactor can't
quietly diverge from pnpm here.

---
Written by an agent (Claude Code, claude-opus-4-7).

`pickRegistryForPackage('@private/foo', 'npm:lodash@^1')` previously
returned `registries["@Private"]`, even though the fetched package
is unscoped `lodash` and doesn't live on the `@private` registry.
The local alias slot is just where the install lands in
`node_modules`; it must not drive registry routing when the npm-
alias target itself is unscoped.

`getScope` now returns `null` in the npm-alias branch when the
target is unscoped (instead of falling through to the local
pkgName's scope), so the call falls through to `registries.default`.
The scoped-target case (`npm:@scope/name`) is unchanged: it still
returns the target's scope, overriding the local key's scope as
before. Adds a TS test covering the bug case.

Mirrored in pacquet's `pick_registry_for_package` (the previously
chained `scope_from_bare_specifier(...).or_else(|| scope_of(pkg_name))`
collapsed into a single branch). The pacquet regression test now
asserts the corrected default-routing behavior.

Thanks to @coderabbitai for catching this.

---
Written by an agent (Claude Code, claude-opus-4-7).

* `resolve_node`'s `Ok(None)` from the resolver chain is no longer
  silently flattened away. The resolver-base contract says `None`
  means "this resolver declined" — outside `DefaultResolver`'s
  internal `??` fall-through, that's a contract violation that
  would leave installs missing dependencies (e.g. an unported
  `git+ssh://` spec would just disappear from the tree). The tree
  walker now surfaces it as a typed `SpecNotSupported` error with
  code `SPEC_NOT_SUPPORTED_BY_ANY_RESOLVER`, mirroring upstream's
  `default-resolver` error and using the same `{alias}@{bare}`
  rendering. Updated the regression test to assert the error
  rather than an empty tree.

* `resolve_dependency_tree` no longer wraps the context in an
  `Arc`. The per-direct-dep futures now borrow `&Ctx` directly;
  `try_join_all` keeps the borrow alive for the duration of the
  resolve pass, and after the await we move the locked maps out
  via `into_inner()`. Removes the `Arc::try_unwrap(...).expect(...)`
  that would have panicked on an unexpected outstanding clone — a
  panic in a library API is not the right failure mode even when
  it "shouldn't happen."

---
Written by an agent (Claude Code, claude-opus-4-7).

`install_subtree` used `Sender::send(true)` to signal that the first
writer for a virtual-store slot had finished materializing. But
`Sender::send` returns `Err` when the channel has zero receivers —
and the watch channel I create per slot has zero receivers at the
moment of `send` whenever the first writer finishes before any
second visitor subscribes (true for cyclic and diamond graphs:
`A → B → A` enters the second `install_subtree(A)` only AFTER the
outer writer already ran `IPFR::run` and tried to send).

Under `send`, that race silently failed: the sender's stored value
stayed `false`, the cycle's inner second-visit subscribed, saw
`false`, and `changed().await` blocked forever. CI flagged this on
the `should_install_circular_dependencies` test (hung past 6 minutes)
plus two `lifecycle_scripts` tests with similar diamond shapes.

`send_replace(true)` always writes the value and returns the old
one regardless of receiver count, so the freshly-subscribed
receiver's first `borrow_and_update()` immediately observes `true`
and breaks the wait loop. Added a comment naming the race and
why `send_replace` is required.

Verified locally: `should_install_circular_dependencies` now
passes in 8.5s; full `pacquet-cli` suite (84 tests) passes in 46s.

---
Written by an agent (Claude Code, claude-opus-4-7).

`config.minimum_release_age` is `u64` (minutes); the previous
`minutes as i64` cast wraps silently when the value exceeds
`i64::MAX`, and `chrono::Duration::minutes` can overflow internally
before the subtraction even runs. An absurd configured value could
produce a cutoff in the wrong direction (everything mature, or
nothing mature) rather than failing or ignoring the setting.

Use a chain of checked operations at both call sites — the resolve
pass in `install_without_lockfile.rs` and the verifier factory in
`create_npm_resolution_verifier.rs`:

* `i64::try_from(minutes)` → catches the `u64 → i64` boundary.
* `chrono::Duration::try_minutes(...)` → catches the minutes-to-
  internal-units overflow.
* `DateTime::checked_sub_signed(...)` → catches the wall-clock
  underflow.

On overflow at any step the cutoff degrades to `None`, leaving the
policy inactive for the install instead of fabricating a wrong
cutoff. Same shape used at both sites so the resolver-time pick and
the lockfile-verification gate degrade identically.

---
Written by an agent (Claude Code, claude-opus-4-7).