fix(npm): resolve cached package name from install dir for non-registry specs

[sjawhar]

Issue for this PR

Closes #23653

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Fixes the regression introduced in #18308 where Npm.add() cached install dirs keyed on npa(pkg).name, which returns undefined for non-registry specs (remote tarball URLs, git+https://, GitHub shorthand like Edison-A-N/opencode-preview, file: paths). On a cache hit the code then called resolveEntryPoint(undefined, ...), breaking subsequent installs of these specs.

The fix recovers the actual installed package name by reading the install-root package.json (written by Arborist on the initial install) and using its first dependency entry — matching what the fresh-install path computes from the arborist tree below it.

Why this works:

• For registry specs (lodash@4), npa(pkg).name returns the package name as before — unchanged.
• For non-registry specs with a previously installed cache, the cached package.json contains a dependencies map whose first key is the actual installed package name (Arborist writes this when reifying). We read that name and resolve against node_modules/<actual-name>/ correctly.
• For cache directory exists but no parseable deps (corrupted/partial cache), we fall through to the Arborist install path so the package gets re-reified instead of returning a broken entrypoint.

How did you verify your code works?

• New unit tests in packages/opencode/test/npm.test.ts covering:
  • Cache-hit path returning the actual installed package name (not the npa-derived undefined)
  • Re-install behavior when the cache directory exists without the package installed (corrupted cache recovery)
  • Registry-spec path unchanged
• Full packages/opencode and packages/core test suites run locally — pass
• bun typecheck passes on both packages

Screenshots / recordings

N/A — no UI changes.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

---

Closes #23653

Supersedes #25744 (closed by the inactivity bot). Rebased onto latest dev with all merge conflicts resolved; typecheck and targeted tests pass on the fork branch.

[github-actions]

Automated PR Cleanup

Thank you for contributing to opencode.

Due to the high volume of PRs from users and AI agents, we periodically close older PRs using automated criteria so maintainers can focus review time on the most active and community-supported contributions.

This PR was closed because it matched the following cleanup criteria:

• The PR was created more than 1 month ago
• The PR had fewer than 2 positive reactions
• Positive reactions are counted as thumbs-up, heart, celebration, or rocket reactions on the PR

PRs created within the last month are not affected by this cleanup.

If you believe this PR was closed incorrectly, or if you are still actively working on it, please leave a comment explaining why it should be reopened. A maintainer can review and reopen it if appropriate.

Thanks again for taking the time to contribute.