fix(install): verify modern Yarn hashes against the CLI binary

[leslieeilsel]

Summary

• verify Yarn 2+ packageManager hashes against the extracted bin/yarn.js, matching Corepack
• re-verify the same binary when using an existing Vite+ package-manager cache
• preserve tarball hash verification for npm, pnpm, and Yarn Classic

Why

Corepack writes Yarn 2+ integrity pins from the extracted CLI binary, while Vite+ previously compared them with the npm tarball hash. This made valid Corepack pins fail with a cold Vite+ cache and appear to pass with a warm cache because the cached artifact was not re-verified.

Fixes #2209

Test Plan

• cargo fmt --all -- --check
• cargo test -p vite_install --locked
• cargo check -p vite_install --all-features --all-targets --locked
• cargo clippy -p vite_install --all-targets --all-features --locked -- --deny warnings
• verified the Yarn 4.17.1 Corepack pin from vp install rejects a Corepack-written packageManager pin: vp hashes the .tgz, Corepack hashes the extracted binary #2209 with cold and warm caches
• verified that a corrupted cached yarn.js returns HashMismatch without downloading again

[netlify]

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	453e2ef
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a61b0edfe024c000881ca3a