feat(install,store,ci): Phase 66 Phase 4d — v1→v2 silent migration + default flag flip

[tolgaergin]

Summary

The Phase 4 series's user-visible payoff. After this lands, an upgrade-in-place user runs lpm install once and gets the v2 virtual-store layout: project node_modules/<dep> becomes a symlink into ~/.lpm/store/v2/links/<graph-key>/..., the cross-project sharing v2 was designed for kicks in, and v1's per-project <project>/.lpm/wrappers/ ceases to exist. Explicit LPM_STORE_VERSION=v1 remains as a downgrade-rollback for users hitting a v2 regression.

Stacks on #32 (Phase 4c — read pipeline supports v1 and v2). Will auto-rebase after #30 → #31 → #32 land.

What's in this PR

Two commits:

1. Phase 43 — Tarball URLs in the lockfile #5 + fix(registry): honor --insecure end-to-end on tarball paths + Phase 43 gate #6 perf followups [b4ecebd] — speculative pre-fetcher routes through v2 instead of draining as no-op (Phase 43 — Tarball URLs in the lockfile #5); v1→v2 cache-hit translation via Store::populate_object_from_v1 so upgrade-in-place users don't pay full re-download cost on their first v2 install (fix(registry): honor --insecure end-to-end on tarball paths + Phase 43 gate #6). Both were deferred from Phase 4b's handoff so 4d's perf comparison can be honest.

2. Migration + default flip [0f956bf] — commands::install::needs_v2_migration + migrate_v1_to_v2 per preplan §3.1/§3.2. Freshness gate dual-wired (install_state slow path + try_mtime_fast_path). StoreVersion default flips from V1 → V2; parse rule re-pivots so unset/typos → V2, explicit v1/1 → V1. CI matrix flipped (v2 is now natural default; v1 row exercises explicit downgrade). 6 new migration unit tests; existing parser tests rewritten for post-flip semantics. Test-infra scoping: workflow helper + install_global TestEnvGuard pin to LPM_STORE_VERSION=v1 since those tests assert on v1 layout shape.

Migration sequence (preplan §3.2)

1. rm -rf <project>/.lpm/wrappers/
2. rm -rf <project>/.lpm/hoisted/
3. rm -rf <project>/node_modules/ (entirely, including .bin/)
4. rm -f <project>/.lpm/install-hash

Each step is idempotent. Sidecars (build-state.json, trust-snapshot.json) survive. The store-side ~/.lpm/store/v1/ is intentionally not wiped — other projects on the same machine may still reference it; users opt into pruning via lpm cache prune --legacy-v1 (Phase 4e).

v2 cache-hit gate completeness

Three short-circuits in install-pipeline order:

1. v2 native — objects/<sri>/ already exists (catches the speculative pre-fetcher's writes).
2. v1 → v2 translation — v1 has bytes + we know the SRI → copy into objects/<sri>/.
3. v1 native — pre-existing.

Without #1, mocked workflow tests (each tarball expect(1)) double-fetched once spec was wired through.

Pre-merge gate

cargo clippy --workspace --all-targets -- -D warnings  ✓
cargo fmt --check                                       ✓
cargo nextest run --workspace --exclude lpm-integration-tests
  → 5728 tests pass, 7 skipped                          ✓
cargo test -p lpm-auth (parallel-deterministic)         ✓
./bench/audit-fixtures/run-all.sh
  → 17 PASS / 1 SKIP / 0 mixed (v2 default)            ✓
LPM_STORE_VERSION=v1 ./bench/audit-fixtures/run-all.sh
  → 17 PASS / 1 SKIP / 0 mixed (v1 downgrade)          ✓

End-to-end migration smoke

$ LPM_STORE_VERSION=v1 lpm-rs install
   → <project>/.lpm/wrappers/ populated
$ lpm-rs install                              # v2 default
   → migration message + clean reinstall
$ ls .lpm                                     # wrappers gone
   build-state.json install-hash trust-snapshot.json
$ readlink node_modules/react
   /Users/tolga/.lpm/store/v2/links/react@18.3.1+2cc2a540a44d10db/node_modules/react
$ lpm-rs doctor | grep node_modules
   ✔ node_modules    symlinks into ~/.lpm/store/v2/links/

Out of scope (queued)

• Phase 4e — lpm cache prune (orphan detection in ~/.lpm/store/v2/, --legacy-v1 retirement of v1 store).
• Phase 4f — linker default flip (isolated → hoisted), dual-gated on bench: hoisted warm-install ≤ 200 ms absolute AND ≤ isolated + 30 ms paired.
• README bench refresh — runs against 4f's bench gate, not 4d's correctness gate.

Test plan

• All new unit tests pass (6 migration + 5 parser + Phase 43 — Tarball URLs in the lockfile #5/fix(registry): honor --insecure end-to-end on tarball paths + Phase 43 gate #6 follow-ups)
• Full nextest workspace run passes (5728 tests)
• Audit fixtures green under v2 default
• Audit fixtures green under explicit LPM_STORE_VERSION=v1 downgrade
• End-to-end migration smoke (v1 install → default reinstall → v2 layout + doctor virtual healthy)
• CI matrix green on both audit-fixtures (v1) and audit-fixtures (v2) rows

🤖 Generated with Claude Code