The pnpm 10 self-update handler passed the general resolved configuration to both the package resolver and the engine identity verifier. Workspace settings can preserve otherwise unknown runtime keys, so repository configuration could overwrite the internal package-manager registry and the verifier's test-only trusted-key override.
Construct resolver and installer options from the dedicated package-manager bootstrap configuration, which is captured from non-project sources before workspace settings are merged. Move the shared bootstrap helper into `@pnpm/config` so automatic version switching and self-update use the same boundary. Pass unsigned-fixture keys through a separate explicit test argument instead of the runtime command options.
Also skip automatic loading of the default project pnpmfile for self-update, while preserving its behavior for other commands. Add regressions for registry redirection, identity-verification bypass, trusted bootstrap config, and pnpmfile loading.
* fix: `shamefullyHoist` set via `updateConfig` in `.pnpmfile.cjs`
* refactor: consolidate derived config processing to cli-utils
Move shamefullyHoist → publicHoistPattern conversion from
config/config to cli-utils/getConfig.ts as suggested in review.
* test(config): update tests for derived config processing move
* refactor: move applyDerivedConfig to cli-utils
* refactor: move applyDerivedConfig to cli-utils
* test: use unit test for hoist: false in cli-utils
* revert: not needed changes
close#10271
