Fix npm-family restore ignoring project registry (#908, #521) (#918)

* Start fix for #908, #521

Assisted-by: Claude Code:claude-opus-5-5

* Restore berry and vlt pins from project registry

Hosted rollback and remove looked up a package's version document on
the default registry (npmjs or SOCKET_NPM_REGISTRY) only. On a project
that installs from a mirror whose tarball URLs are off the usual path,
that broke the restored lock:

- yarn berry wrote a bare npm: locator, so a cold-cache install asked
  the mirror for a path it never serves and failed with a 404 (#908).
- vlt rebuilt slot [3] as <registry>/<name>/-/<leaf>-<ver>.tgz instead
  of the URL the registry advertises, which vlt ci can 404 on (#521).

The restore now reads the document from the registry the project
resolves the package against (.yarnrc.yml npmRegistryServer, the vlt
node's registry) and vlt takes slot [3] from its dist.tarball. If that
registry can't be read (for example it needs credentials), the old
default-registry lookup is used and upstream_registry_fallback warns.

Fixes #908
Fixes #521

Assisted-by: Claude Code:claude-opus-5-5

* Name the per-registry npm cache type

Keeps clippy's type_complexity lint quiet for the restore client's
registry-keyed version-document cache.

Assisted-by: Claude Code:claude-opus-5-5

* Keep npmScopes packages on the default lookup

A scoped package in a .yarnrc.yml with an npmScopes block may resolve
against its scope's registry rather than npmRegistryServer, so berry
restore keeps reading its document from the default registry, as
before, instead of asking a registry that may not host it.

Assisted-by: Claude Code:claude-opus-5-5

* Route Gradle digests through utils::digest

main's test suite is red: the Gradle cache, jar and Maven sidecar code
from #646 hashes inline, which the digest guard test from #865 forbids,
so coverage and the macOS/Windows test jobs fail on every PR. This is
the same change as #878, ported so this PR can go green; it no-ops
once #878 lands.

Assisted-by: Claude Code:claude-opus-5-5

* Serialize berry checksum tests that read SOCKET_NPM_REGISTRY

The npm dist cache is now keyed by registry base, and these two tests
seed it under npm_registry_base(), which reads SOCKET_NPM_REGISTRY.
Serial vlt/bun tests set that variable, so when one ran in parallel the
lookup key no longer matched the seeded entry and the test fetched
left-pad from the other test's mock server (404). That is the
test (windows-latest) failure on 48798c4. Serializing them with the
env-mutating tests closes the race.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: mikolalysenko