feat: resolve package manager bins from package manifests

[Aschenbath]

When a package manager moves its executable, Corepack can download a valid tarball and then fail with MODULE_NOT_FOUND because it uses a configured path. Tarball installations now read executable paths from the downloaded package's package.json, allowing layouts such as pnpm's .cjs → .mjs migration to work without a Corepack release.

• Keep configured command names as an allowlist for supported package managers; omit absent optional aliases and ignore unrelated commands. Support object and string bin declarations, including scoped package names.
• Validate entry points and the manifest against the real package root. Reject absolute/escaping paths, missing files, directories, and symlinks resolving outside the package; remove temporary downloads on bin-validation failures.
• Cache the resolved relative paths. Preserve single-file Yarn handling and the existing integrity checks. Existing cache records remain compatible.
• Document the behavior and add 43 regressions covering changed paths, aliases, argument forwarding, offline reuse, malformed declarations, and path containment.

Validation on Node.js 24.20.0 using the repository's existing node_modules:

• Build/bundle and shim generation passed.
• node node_modules/typescript/bin/tsc --noEmit passed.
• node node_modules/eslint/bin/eslint.js --max-warnings=0 passed.
• git diff --check passed.
• Full Vitest suite, NOCK_ENV=replay, retries disabled: 10 files passed; 214 tests passed and 1 existing expected failure (215 total).
• Before the fix, the new moved-pnpm CLI regression fails against the original main implementation with ERR_MODULE_NOT_FOUND for bin/pnpm.mjs; it passes with this change.

Full-suite command:

env -u NODE_USE_ENV_PROXY -u http_proxy -u https_proxy -u all_proxy -u no_proxy \
  NOCK_ENV=replay TMPDIR=/var/tmp NODE_DISABLE_COMPILE_CACHE=1 DISABLE_V8_COMPILE_CACHE=1 \
  NODE_OPTIONS=--require=/home/hatch/workspace/corepack/.git/task-tools/test-env.cjs \
  node node_modules/vitest/vitest.mjs run --maxWorkers=2 --retry=0 --reporter=verbose

The local, uncommitted preload retains outbound proxy access for the existing live npm signing-key check while clearing inherited proxy settings for fixture CLIs. No tests are skipped or changed for this environment adjustment. The expected failure is already declared with it.fails in tests/main.test.ts:75 (should refuse to download a known package manager from a URL in package.json).

Closes #775.

Implementation and automated validation were performed by Codex.