fix(redirect): atomic fail-closed ledger, ledger-aware updates[] - #192

Reconciles with #192 (fix/redirect-ledger-atomicity), which already
landed the ledger-before-lockfiles ordering, the atomic ledger write
(save_redirect_state), and the fail-closed corrupt-ledger load with
.corrupt quarantine. Kept all of main's #192 machinery and re-expressed
this PR's remaining value on top of it:

- Lockfile writes go through atomic_write_bytes_preserving_mode
  (main still used bare fs::write for the rewrite.files loop).
- FileEdit derives PartialEq and the ledger merge skips byte-identical
  re-planned edits from a retried partial failure.
- parse_purl_simple percent-decodes the version like the name.
- New test partial_lockfile_write_failure_persists_ledger_originals
  (mid-run multi-lock failure: originals durable, failed lock
  byte-untouched).
- Leg 3 of the write-failure envelope test obstructs the lock's
  DIRECTORY (unix-gated): with atomic writes a read-only lock FILE is
  replaced mode-preserved instead of failing.

Dropped as subsumed by #192: load_redirect_state_strict (superseded by
CorruptRedirectState), this branch's own atomic ledger write and
ledger-first ordering, and corrupt_ledger_is_refused_not_replaced
(superseded by corrupt_ledger_fails_closed_and_preserves_the_bytes,
whose quarantine semantics intentionally MOVE the corrupt file).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ly purls (#206)

* test(vendor): RED — npm-family mode-migration e2e twins of the cargo C1-C7 capstones

mode_migration_npm.rs drives the real binary + corepack yarn (classic and
berry) through hosted -> vendored -> revert, and vendored -> hosted,
asserting the cross-mode takeover contract #196 shipped for cargo:

- hosted -> vendored must pre-revert the hosted lock edits (so the vendor
  ledger records the PRISTINE registry originals), drop the purl's
  redirect-ledger record+edits, and surface vendor_takeover_reverted_redirect
- vendor --revert afterwards must land back on REGISTRY state byte-identical
- vendored -> hosted must revert the vendored wiring per purl first
  (redirect_takeover_reverted_vendored), not leave overlapping ledgers

All three tests FAIL on main (takeover machinery is hard-gated to
pkg:cargo/ at cli vendor.rs:993 and scan/hosted.rs:336):

    test berry_hosted_then_vendored_takeover_round_trips_to_registry ... FAILED
    test classic_hosted_then_vendored_takeover_round_trips_to_registry ... FAILED
    test classic_vendored_then_hosted_takeover_leaves_pure_hosted ... FAILED
    (takeover advisory missing from the vendor envelope /
     takeover warning missing: redirect_supersedes_vendored fired instead)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(vendor): pre-revert live hosted redirects when vendoring npm-family purls

The cross-mode takeover that #196 built for cargo (C1-C7) was hard-gated
to pkg:cargo/ in BOTH directions:

- cli vendor.rs:993 — the vendor dispatch loop's pre-revert ("Cross-mode
  takeover (cargo)"), so vendoring an npm purl over a LIVE hosted
  redirect (a) recorded the grant-tokenized HOSTED lock fragment as the
  vendor ledger's unrecoverable pre-vendor original, (b) never dropped
  the superseded redirect records/edits — the vendor_supersedes_redirect
  warning's promised auto-reconcile provably never converged — and
  (c) made vendor --revert land back on the expiring hosted URL with no
  CLI path to registry state (adversarially confirmed P1, cells
  convy1-hosted2vendored + E5, yarn 1 and yarn 4).
- scan/hosted.rs:336/346 — the reverse direction, so a hosted scan over
  live vendored npm wiring either hijacked the vendored resolution while
  the vendored ledger still claimed it (classic) or refused outright
  (berry file: protocol).

Fix, porting the cargo pattern to the npm family:

- core redirect/takeover.rs: revert_npm_redirect_purl replays each
  recorded FileEdit.original over its .new — text-fragment kinds
  (yarn classic / yarn berry / pnpm, keyed name@version) via staged
  replacen, package-lock JSON kinds (redirect_npm_lock_entry /
  redirect_npm_lock_dep, alias entries resolved through the lock's
  name field exactly as the rewriter matched them) via a staged JSON
  replay — with the same fail-closed contract as cargo: every inverse
  resolves against a staged view, drift refuses byte-identically, and
  only a fully clean replay drops the record+edits (caller persists).
  A bun.lock edit for the purl is a hard refusal (no bun replay yet).
  New: redirect_revert_supported + revert_redirect_purl dispatcher;
  CargoRedirectRevert kept as an alias of the renamed RedirectRevert.
- cli vendor.rs: gate widened from pkg:cargo/ to
  redirect_revert_supported (cargo + npm); the corrupt-ledger refusal
  and dry-run vendor_would_revert_redirect warning now cover npm too;
  ecosystem-appropriate takeover advisory text.
- cli scan/hosted.rs: reverse takeover gate widened to cargo + npm
  (dispatch_revert_one already handles npm); the no-ledger wired-check
  stays cargo-only; refused-override filtering now keys by
  (ecosystem, coordinate, version).

Ledger transactionality per #192/#187 precedent is preserved: the
redirect ledger is persisted before vendoring proceeds, and a persist
failure fails that purl closed.

Unit tests: real-rewriter round-trip fixtures for classic, berry, and a
lockfileVersion-2 package-lock (both trees), drift refusal, bun
refusal, gate coverage.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(takeover): version-scope the npm package-lock edit claims

The npm JSON lock-edit claim matcher was name-only: reverting
pkg:npm/name@X claimed and replayed the ledger edits belonging to
pkg:npm/name@Y (a sibling hosted-redirected version) and alias-keyed
edits belonging to a different package whose lock path merely equals
`name` — silently un-hosting the other purl (v3 `packages`) or
spuriously drift-refusing the whole takeover (v2 `dependencies`),
while the rewriter had matched on entry name AND version. Same bug
class as the pnpm multi-version clobber: bind claims to name@version,
not name-only.

`redirect_npm_lock_entry` now attributes a live entry exactly the way
the rewriter matched it — effective name (the `name` field npm writes
for alias installs, else the key's trailing path) AND version — and a
vanished entry keeps the fail-closed "no longer exists" refusal via
key path + the recorded resolved URLs (which embed the version behind
`/<version>/` or `-<version>.tgz` delimiters, so sibling versions
never cross-match). `redirect_npm_lock_dep` (bare-name key) gains the
same URL-based version discriminator.

New adversarial fixtures (both RED against the old matcher): a
two-version package-lock (v2, both trees) where taking over 1.3.0 must
leave 1.2.0's redirect and ledger intact, and an alias collision where
`npm i left-pad@npm:other` must be exonerated by the entry's `name`
field while `npm i mylp@npm:left-pad` is still claimed through it;
plus a guard that a pruned lock entry still fails closed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>