fix(cli): honor declared package manager versions

[Upd4ting]

Summary

• preserve the complete packageManager declaration instead of dropping its version
• execute declared npm, Yarn, and pnpm versions through Corepack when available
• retain global-binary compatibility for projects without a declaration and environments without Corepack
• keep downloaded-package installs frozen while allowing module initialization to refresh copied template lockfiles after adding interfaces

Rebase status

Rebased onto origin/main at b507915de42ae37bea694c99078fefdbf302d6c9 (runtime PRs #97, #98, #100, and #101). Current head: 572979ade79142df9fc8c18da82d78eaaf17ce29.

git range-diff reports both PR commits patch-identical across the rebase. The incremental PR diff contains only:

• src/core/cli/package-manager.ts
• src/core/cli/commands/module/init.ts
• their two focused test files

The rebased frozen install resolved published @antelopejs/interface-core@0.0.11 from the new base.

Deterministic-success matrix

Environment: Node 20.9.0, Corepack 0.20.0, globally installed pnpm 11.22.0. Timings are single-run sanity measurements.

Scenario	Resolved command/version	Result
Original failure: declared pnpm 10.6.5, incompatible global pnpm 11	global pnpm install	0/1 succeeded (node:sqlite)
Rebased root install	corepack pnpm@10.6.5 install --frozen-lockfile	succeeded; lockfile unchanged; interface-core 0.0.11 installed
Stale npm lock, frozen contract	corepack npm@10.2.4 ci --prefer-offline	failed as intended (EUSAGE) in 408 ms; lock unchanged
Stale npm lock, init/update contract	corepack npm@10.2.4 install --prefer-offline	succeeded in 526 ms; lock refreshed
Stale pnpm lock, frozen contract	corepack pnpm@10.6.5 install --ignore-workspace --frozen-lockfile --prefer-offline	failed as intended (ERR_PNPM_OUTDATED_LOCKFILE) in 417 ms; lock unchanged
Stale pnpm lock, init/update contract	corepack pnpm@10.6.5 install --ignore-workspace --prefer-offline	succeeded in 640 ms; lock refreshed

Call-site contract

There are two production call sites for getInstallCommand:

Call site	Contract	Lockfile mode
package downloader	immutable published package installed into cache	frozen by default
module initialization	copied template may receive selected interfaces	explicit update

All three official module templates currently contain a pnpm-lock.yaml, so initialization must be able to refresh copied locks. Package downloads remain strict.

Command/compatibility matrix

Manifest	Frozen download/build	Mutable initialization	Real Corepack resolution
pnpm@10.6.5	frozen + prefer-offline	update + prefer-offline	10.6.5
yarn@1.22.21	frozen + prefer-offline	update + prefer-offline	1.22.21
npm@10.2.4	ci + prefer-offline	install + prefer-offline	10.2.4
no field / unsupported field	global npm fallback	global npm fallback	unchanged compatibility
declared version, Corepack absent	matching global binary fallback	matching global binary fallback	version cannot be guaranteed

Validation on rebased head

• frozen root install: passed; @antelopejs/interface-core resolved to 0.0.11
• pnpm build: passed
• pnpm test: passed with pinned pnpm shim
  • unit suite: 660 passing
  • package consumer added by fix(runtime): route interface calls to selected providers #101: passed
  • playground: all 3 phases passed
• pnpm test:coverage: passed — 94.56% statements/lines, 92.28% branches, 91.98% functions
• pnpm lint: passed with 2 pre-existing warnings and 1 pre-existing informational diagnostic
• stale-lock npm and pnpm reproductions: frozen failed without mutation; init/update succeeded and refreshed locks
• declared-version probes: npm 10.2.4, pnpm 10.6.5, Yarn 1.22.21 resolved exactly

Environment limitation

This orb's global pnpm 11.22.0 requires a newer Node version than Node 20.9.0. Repository scripts contain nested bare pnpm calls, and the #101 package-consumer fixture intentionally has no packageManager; without a pinned shim those nested calls select pnpm 11 and fail before exercising repository code. Validation therefore prepended a temporary pnpm wrapper that delegates to corepack pnpm@10.6.5. No wrapper or environment-specific change is committed.

The earlier Greptile P1 was addressed in the second commit; its review thread remains resolved. This PR must not be merged as part of this update.