Add n/prefer-node-protocol rule and autofix all bare builtin imports
to use the node: prefix. Simplify the simple-import-sort builtins
pattern to just ^node: since all imports now use the prefix.
Add eslint-plugin-simple-import-sort to enforce consistent import ordering:
- Node.js builtins first
- External packages second
- Relative imports last
- Named imports sorted alphabetically within each statement
## Summary
Store config dependency and package manager integrity info in a separate `pnpm-lock.env.yaml` lockfile instead of inlining it in `pnpm-workspace.yaml`. The workspace manifest now contains only clean version specifiers for `configDependencies`, while the resolved versions, integrity hashes, and tarball URLs are recorded in the new env lockfile.
### Key changes
- **New `pnpm-lock.env.yaml` lockfile**: Uses the standard lockfile format (`importers`, `packages`, `snapshots`) to store resolved config dependencies and package manager dependencies with integrity hashes and tarball URLs.
- **Automatic migration**: Projects using the old inline-hash format in `pnpm-workspace.yaml` are automatically migrated on install.
- **Global Virtual Store (GVS) for version switching**: When switching pnpm versions via the `packageManager` field, pnpm is installed to the global virtual store (`$STORE_DIR/links/`) instead of `globalPkgDir`, reusing the content-addressable store for deduplication.
- **Self-update uses headless install**: `pnpm self-update` performs frozen headless installs using integrity hashes from the env lockfile, then links bins to `PNPM_HOME`.
- **`packageManagerDependencies`**: The env lockfile also stores resolved `packageManagerDependencies` during version switching and self-update.
- **`@pnpm/exe` support**: Replicates `@pnpm/exe`'s postinstall script (linking platform-specific binaries) since install scripts are disabled.
- **`pnpm setup` refactored**: Uses `pnpm add -g` instead of copying the CLI binary directly.
- **Extracted `toLockfileResolution`** to `@pnpm/lockfile.utils` and **deduplicated `iteratePkgMeta`** into `@pnpm/calc-dep-state`.
- **Removed unused `@pnpm/tools.path` package**.
* feat: enable injected local packages to work with global virtual store
by leveraging `pkgLocationsByDepPath` for `file:` dependencies.
* fix: populate `pkgLocationsByDepPath` directly for directory dependencies in the graph builder
* refactor: store directory dependencies as a Map instead of an object
* refactor: improve file: dependency target directory resolution
by prioritizing `directoryDepsByDepPath` and providing a lockfile fallback.
* refactor: remove `pkgLocationsByDepPath` from hoisted dependency graph generation parameters
* test: fix
* test: fix
* refactor: simplify directory lookup for injected workspace packages
by directly using the dependency graph
* refactor: move extendProjectsWithTargetDirs to headless module and update imports
* refactor: make `directoryDepsByDepPath` required
in `LockfileToDepGraphOptions` and remove its nullish coalescing in headless
* refactor: directory dependency tracking
by renaming `directoryDepsByDepPath` to `injectionTargetsByDepPath`
and extracting related logic, and remove an unused export.
* docs: add changesets
* fix: implemented CR suggestions
* refactor: replace `forEach` with `for`-loops
Changes:
* Most `Object.keys(o).forEach` are replaced by `for in`.
* Most `Array.filter(c).forEach` are replaced by `for of` + `if continue`.
* `return` in `forEach` callbacks are replaced by `continue`.
There may be minor improvement to memory footprint as this change would
reduce the creations of temporary arrays and temporary functions.
* fix: return -> continue
* refactor: remove the commented out code
