fix(install): verify modern Yarn hashes against the CLI binary

[leslieeilsel]

Summary

• verify Yarn 2+ packageManager hashes against the extracted bin/yarn.js, matching Corepack
• re-verify the same binary when using an existing Vite+ package-manager cache
• preserve tarball hash verification for npm, pnpm, and Yarn Classic

Why

Corepack writes Yarn 2+ integrity pins from the extracted CLI binary, while Vite+ previously compared them with the npm tarball hash. This made valid Corepack pins fail with a cold Vite+ cache and appear to pass with a warm cache because the cached artifact was not re-verified.

Fixes #2209

Test Plan

• cargo fmt --all -- --check
• cargo test -p vite_install --locked
• cargo check -p vite_install --all-features --all-targets --locked
• cargo clippy -p vite_install --all-targets --all-features --locked -- --deny warnings
• verified the Yarn 4.17.1 Corepack pin from vp install rejects a Corepack-written packageManager pin: vp hashes the .tgz, Corepack hashes the extracted binary #2209 with cold and warm caches
• verified that a corrupted cached yarn.js returns HashMismatch without downloading again

[netlify]

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	c3609f2
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a75a2e3b4f08100082026f3

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[leslieeilsel]

Local verification results (run on macOS, nightly-2026-08-02)

Since the CI workflows are waiting for maintainer approval, I ran the checks locally on commit 26615d1:

• ✅ cargo test -p vp_pm_cli --lib — 734 passed, 0 failed (2 ignored), including package_manager::tests and request::tests
• ✅ cargo fmt --check — clean
• ✅ cargo clippy -p vp_pm_cli --lib -- -D warnings — no warnings

One note: the PR description's Test Plan references vite_install, but the changed crate is vp_pm_cli (the commands above use the actual crate name).

Could a maintainer please approve the workflow runs? Thanks! 🙏