Fix npm store children classified two ways (#1899) (#1986)

* Start fix for #1899

Assisted-by: Claude Code:claude-opus-5-5

* Classify npm store children through one helper

apply could patch a package copy that scan never reported. Inside a
store entry's own node_modules (for example
.pnpm/<entry>/node_modules), the scan never treats a .pnpm, .bun,
.deno, .vlt, .store, .modules.yaml or .registry.* child as a store,
but the apply/vex resolver did and walked it.

Both walks now classify a node_modules child through one
StoreKind::classify(name, file_type, in_store_entry), and the
resolver passes the store-entry flag the scan already used. An empty
.modules.yaml store no longer queues an empty entry list. A
regression test covers every store name nested in a store entry.

Refs #1899

Assisted-by: Claude Code:claude-opus-5-5

* Skip nested stores in apply's peer fan-out too

apply's peer-variant fan-out walked up from a patched copy and probed
every ancestor node_modules for a store, including a store entry's
own node_modules. A peer variant in a nested .pnpm there was patched
although scan never reports it. That walk now skips a store entry's
node_modules, matching the scan and the resolver.

The test oracle for find_by_purls follows the same store-entry rule,
and the regression test now also covers .vlt, a .modules.yaml
relocated store and the peer fan-out. Review cleanups: the resolver's
store listing returns a plain Vec, a misplaced #362 doc comment is
back on its own test, and the walk docs point at StoreKind::classify.

Refs #1899

Assisted-by: Claude Code:claude-opus-5-5

* Skip nested stores of every entry shape

The peer fan-out's nested-store check only recognised a
<store>/<entry>/node_modules path. A store nested in a scoped npm
.store entry, a pnpm <=3 .registry.* entry or an entry of a store
relocated by virtualStoreDir was still probed, so apply could patch a
peer copy scan never reports. The fan-out now drops any found store
that sits inside another found store or inside a store-named dir.

Refs #1899

Assisted-by: Claude Code:claude-opus-5-5

* Keep the peer fan-out's store when a store name sits above it

is_inside_another_store matched store names on every ancestor, and the
ancestor walk also collects any `.pnpm`/`.bun`/`.deno`/`.vlt` dir above
the project into `stores`. A project under `~/.bun` (Bun's global
install root), `~/.deno` or `~/.vlt` therefore had its own store
dropped, so apply and rollback silently skipped peer-variant copies
the scan still reports, the reverse of the #1899 disagreement.

A fixed store name now counts only on a `node_modules` child, and the
`stores` comparison only counts stores without a fixed name (those
relocated by `virtualStoreDir`). A new test covers projects under
`.deno`, `.vlt` and `.bun/install/global`; it fails without this change.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: socket-patch-agent <noreply@anthropic.com>

Author: mikolalysenko