[VPEX][5c] Skip constraint cache writes under --check

[rugpanov]

Why

Codex review of the pipeline PR (#5851) flagged that a --check dry run still writes to disk: FetchConstraints populates the on-disk constraint cache on every successful live fetch, so --check mutated the cache directory whenever it was writable — even though the pipeline deliberately skips every other write-side step (writability probe, package-manager availability, the pyproject.toml write) under --check.

The cache lives under os.UserCacheDir() and is disposable, so this was never a correctness or safety bug. But the code frames --check as performing no writes, and this was the one path that broke that framing. This makes behavior match the contract.

What

• Thread a writeCache bool through FetchConstraints. When false, the successful live-fetch path skips writeCacheAtomic. An existing cache is still read for offline fallback, since reading is not a mutation.
• The pipeline passes !p.Check, so a real run caches as before and a dry run does not.

Testing strategy

• TestFetchConstraintsSkipsCacheWriteWhenDisabled — a live fetch with writeCache=false succeeds but leaves the cache dir empty.
• TestPipelineCheckMutatesNothing — strengthened to assert the cache dir stays empty after a --check run (previously it only checked the project file).
• Gates: go build, go test, golangci-lint (0 issues), deadcode, gofmt — all green.

---

About this stack

Follow-up to the databricks local-env python sync stack. It is stacked on #5851 (the six-phase pipeline) because the fix spans two layers: the cache write lives in the fetch layer, but the --check dry-run concept it must respect only exists in the pipeline. Review bottom-up — this PR's diff shows only the cache-write change.

This pull request and its description were written by Isaac.

[eng-dev-ecosystem-bot]

Integration test report

Commit: 3127207

Run: 29096825163

	Env	🟨​KNOWN	💚​RECOVERED	🙈​SKIP	✅​pass	🙈​skip	Time
💚​	aws linux		4	4	230	1069	5:02
💚​	aws windows		4	4	232	1067	7:21
💚​	aws-ucws linux		4	4	314	987	5:31
💚​	aws-ucws windows		4	4	316	985	7:07
💚​	azure linux		4	4	230	1068	5:03
💚​	azure windows		4	4	232	1066	7:06
💚​	azure-ucws linux		4	4	316	984	5:51
💚​	azure-ucws windows		4	4	318	982	7:11
🟨​	gcp linux	1	1	4	229	1070	7:37
💚​	gcp windows		4	4	231	1068	7:41

8 interesting tests: 4 SKIP, 3 RECOVERED, 1 KNOWN

	Test Name	aws linux	aws windows	aws-ucws linux	aws-ucws windows	azure linux	azure windows	azure-ucws linux	azure-ucws windows	gcp linux	gcp windows
💚​	TestAccept	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R
🙈​	TestAccept/bundle/invariant/no_drift	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/bundle/resources/vector_search_endpoints/drift/recreated_same_name	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/bundle/resources/vector_search_indexes/recreate/embedding_dimension	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/ssh/connection	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🟨​	TestFetchRepositoryInfoAPI_FromRepo	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	🟨​K	💚​R
💚​	TestFetchRepositoryInfoAPI_FromRepo/root	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R		💚​R
💚​	TestFetchRepositoryInfoAPI_FromRepo/subdir	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R		💚​R

Top 10 slowest tests (at least 2 minutes):

duration	env	testname
6:41	gcp windows	TestAccept
6:15	aws windows	TestAccept
6:12	aws-ucws windows	TestAccept
6:09	azure-ucws windows	TestAccept
6:04	azure windows	TestAccept
2:56	azure linux	TestAccept
2:55	gcp linux	TestAccept
2:53	aws linux	TestAccept
2:48	aws-ucws linux	TestAccept
2:46	azure-ucws linux	TestAccept

[anton-107]

Approving. Tight, correct follow-up: writeCache threaded through FetchConstraints with the pipeline passing !p.Check, and an existing cache is still read for offline fallback (reading isn't a mutation) — exactly right. Test pair is the right shape: unit (TestFetchConstraintsSkipsCacheWriteWhenDisabled) plus the strengthened end-to-end TestPipelineCheckMutatesNothing asserting the cache dir stays empty. All call sites updated. No findings.