GeezerVison

Vendoring on a pnpm 7/8 lock writes the project's absolute path into
pnpm-lock.yaml. When that path contained " #" or ": " (for example
"My Project #2"), it was written unquoted, so YAML cut it short or
rejected the line and every frozen install failed while vendor
reported success.

The specifier is now spelled the way pnpm itself writes it: plain
when safe, single-quoted otherwise. Re-running vendor heals a lock an
older release left broken, and revert still restores the original
bytes.

Fixes #754

Assisted-by: Claude Code:claude-opus-5-5

* Start fix for #754

Assisted-by: Claude Code:claude-opus-5-5

* Quote pnpm 7/8 vendored specifier when needed

Vendoring on a pnpm 7/8 lock writes the project's absolute path into
pnpm-lock.yaml. When that path contained " #" or ": " (for example
"My Project #2"), it was written unquoted, so YAML cut it short or
rejected the line and every frozen install failed while vendor
reported success.

The specifier is now spelled the way pnpm itself writes it: plain
when safe, single-quoted otherwise. Re-running vendor heals a lock an
older release left broken, and revert still restores the original
bytes.

Fixes #754

Assisted-by: Claude Code:claude-opus-5-5

* Run real pnpm 7/8 vendoring under # and : paths

Adds end-to-end legs that vendor with real pnpm 7.33.5 and 8.15.9 in
project directories named "hash #x" and "colon: x", then require the
same-path frozen offline install to land the patched bytes. Without
the quoting fix both fail with ERR_PNPM_OUTDATED_LOCKFILE.

Refs #754

Assisted-by: Claude Code:claude-opus-5-5

* Skip the ": " test dir on Windows

Windows does not allow ":" in a directory name, so the #754 tests
that create a "colon: x" project dir would fail there before testing
anything. Those cases now run on Linux and macOS only; the " #" case
still runs everywhere.

Assisted-by: Claude Code:claude-opus-5-5

* Drop unrelated cargo fmt --all churn from the #754 fix

The quoting commit reformatted 130 files outside the fix, which buries
the real change and conflicts with every other open PR touching those
files. Restore them to main; the fix itself (pnpm_lock_legacy.rs,
formats/pnpm/lines.rs, e2e_vendor_pnpm_build.rs) is unchanged.

Co-Authored-By: Claude <[email protected]>

---------

Co-authored-by: Claude <[email protected]>