fix(migrate): keep catalog: specs intact through vp up under pnpm - #2425

…sion

The fixture hand-wrote `vite: npm:@voidzero-dev/vite-plus-core@latest` in
the catalog, so `vp up` had a real version bump to perform and the clobber
read as a side effect of that resolution. The reported case pins an exact
version, where the update is a NO-OP and the catalog reference is still
destroyed, which is both the reporter's shape and the sharper repro.

Let `vp migrate` write the pinned version instead of hard-coding one that
would churn each release, then rewind the override key to the pre-fix bare
spelling with `vpt replace-file-content` (which also fails loudly if
migrate ever stops writing the ranged key). `vp up` now reports "Already
up to date" and still rewrites `vite: "catalog:"` to the pinned alias.

Reverts the redaction widening from the previous commit: with an exact pin
no snapshot produces the `@^0.2.8` range form any more.

These 11 fixtures timed out on the local recording pass (slow managed Node/package-manager downloads), so they kept the pre-#2309 bare `vite` override key and failed CI on all three platforms. Every diff is the key rename; no behavior changed.

pnpm 12 fixes the clobber upstream: on 12.0.0-rc.3 a bare override key no longer strips a catalog: importer spec, verified by A/B on identical config (pnpm 11.20.0 rewrites it, 12.0.0-rc.3 does not). The range-qualified key vite-plus writes stays correct there, and still redirects an incompatible transitive edge, so it is not merely a pnpm 9-11 workaround.

The vp up screen is omitted: pnpm 12's update summary reports a package-count delta that churns with the bundled dependency graph.

Apply ASD-STE100 style to the comments and guide text added by this branch: one instruction per sentence, active voice, no ellipsis, and sentences under 25 words. The longest sentence was 52 words. Also removes the em dashes these additions introduced.

Comments and documentation only. No code changed.

Four gaps in the range-qualified override key change.

The monorepo root writer was missed. `rewriteMonorepo` routes root pnpm
settings through `rewriteRootWorkspacePackageJson`, not the standalone
writer, and its pre-10.6.2 branch still spread bare `...managed` keys into
`pkg.pnpm.overrides`. Those workspace-wide bare keys kept matching child
`catalog:` declarations, so `vp up` could still replace them. Both writers
now share one `mergeManagedPnpmOverrides` helper, which is what let the
paths drift apart in the first place.

That helper also carries a legacy bare key's `catalog:<name>` value onto
the ranged key. The package.json paths previously replaced it with the
concrete managed alias, which disconnected the override from the user's
named catalog and contradicted the documented preservation behaviour. A
`file:` managed spec still wins, since force-override mode has no catalog.

`overridesSatisfyVitePlus` read only the ranged key in `pnpm-ranged` mode,
so a map holding BOTH `vite@*` and a legacy bare `vite` reported satisfied.
The fast path then skipped the rewrite and left the clobbering key active.
Any remaining bare managed key now reports unsatisfied.

The managed-vitest sweep was over-broad. `removeManagedVitestEntry` and
`removeYamlMapVitestEntry` deleted `vitest@*` from every sink, but only pnpm
overrides use that spelling. npm also accepts a range in an override key, so
a user-authored `"vitest@*"` in npm `overrides` was silently deleted. Both
now take a key style and sweep the ranged spelling for pnpm sinks only.

Each fix has a unit test that fails without it.

Codex review on 4321a19: `vite@*` does not match a declaration pinning an exact prerelease. pnpm compares with semver.intersects(declaredSpec, keyRange), which is asymmetric for prereleases: intersects('8.0.0-beta.18', '*') is false while the reverse is true. My earlier justification checked the wrong argument order.

Verified on pnpm 11.20.0: a bare key redirects an exact-prerelease declaration, the ranged key does not. No range string avoids it, because node-semver only admits a prerelease when a comparator carries the same version tuple. A prerelease RANGE (^8.0.0-beta.1) still matches, and pnpm 12.0.0-rc.3 matches the exact form too, so the gap is pnpm 9-11 only. A bare key would close it but is what clobbers catalog:, so below pnpm 12 the two cannot both hold.

Corrects the comments and guide text that claimed the range keeps the override on every valid semver range.

The pnpm 9 to 11 exact-prerelease gap stays in the `pnpmOverrideKey`
comment. The migrate-rules and upgrade guides drop it per review.

Apply STE style to the prose added after 98a2fd3: split sentences
over the length limits, keep one statement per sentence, use active
voice, and remove the em dash from the pnpm override bullet.