fix: replay frozen artifacts from the local store before registry access

[ORESoftware]

Root cause

Frozen install already carries immutable package identity and SHA-256 in .zpkg.lock, and the transactional installer can authenticate locally owned store/cache bytes from that lock. The recursive prefetch facade nevertheless performed an unconditional registry.get_version(...) before it entered the shared artifact-acquisition path.

That made exact frozen replay fail after the original registry was deleted, even though the content-addressed store or artifact cache contained the locked bytes. The independent global-profile canary exposed the extracted-store case on Ubuntu and macOS.

Fix

• derive VersionMetadata from the immutable lock whenever the extracted store object or verified artifact cache is present;
• lazily construct and query the configured registry only for genuinely absent locked artifacts;
• continue routing every package through the existing worker pool and shared ensure_artifact path, preserving process locking, cache verification, extraction, and dependency-manifest checks;
• preserve exact identity and SHA comparison whenever registry metadata is required; and
• add a permanent Ubuntu/macOS/Windows focused workflow for formatting, the real replay test, and strict Clippy.

Regression coverage

tests/frozen_offline_prefetch.rs now builds and packs a real package, writes an exact lock, and proves all three states:

1. a cold frozen prefetch downloads and extracts the artifact;
2. after deleting the complete registry, frozen replay succeeds from the extracted content store with zero downloads; and
3. after additionally deleting the extracted store entry while retaining the authenticated cache archive, frozen replay reconstructs the store with zero downloads and no registry metadata.

Exact candidate:

70f01fe35b22f5bbb64281bfca51b51d04927fe7

Independent evidence

zed-pkg-test/zed-pkg-e2e#57 built the compiled CLI at the identical product implementation and passed the complete global-package lifecycle on Ubuntu 24.04 and macOS 15, including first install, collision rollback, deletion of registry and profile materialization, lock/store-only frozen restoration, alias routes, tamper-preserving uninstall, clean uninstall, and credential-marker scanning. That harness merged as 5986aa9784ce4b0837e5bd3d8fce7d64d5710a72.

This PR is synchronized with current main, including canonical asdf routing (#143) and deterministic Devbox/Flox export (#122). Repository-wide and the focused cross-platform gates remain the exact merge gates.

No credential, network registry, or mutable selector is introduced.

[linear-code]

DEN-1898