[Aschenbath]

Exact-version installations can finish before asynchronous signature verification completes, allowing a package manager with invalid signatures to run and enter the cache. This also breaks registries such as Artifactory that omit dist.signatures on the version endpoint and require the package-root metadata fallback introduced in #870.

• Await signature verification in installVersion before checking the integrity hash, writing cache metadata, or running the package manager, and remove the temporary download if verification or metadata lookup fails.
• Add pnpm and Yarn CLI regressions for delayed package-root signatures with token and basic authentication. Reject invalid version/root signatures, missing signatures, and fallback HTTP errors; retry each failed installation and check that no download or last-known-good entry was cached.
• Update existing corepack use assertions to match errors reported through Clipanion after awaiting verification.

Validation (Node.js v24.20.0, repository node_modules):

• node node_modules/typescript/bin/tsc --noEmit — passed.
• node node_modules/eslint/bin/eslint.js — passed.
• Full Vitest suite in replay mode — 8 test files passed; 183 tests passed and 1 existing expected failure. tests/main.test.ts:75 already uses it.fails for rejecting a known package-manager URL in package.json (also present in the base commit).

The test command below isolates lowercase proxy variables from the sandbox, disables inherited proxy setup for CLI children, and enables the required egress proxy for Vitest workers' live npm key check:

env -u http_proxy -u https_proxy -u all_proxy \
  NOCK_ENV=replay TMPDIR=/tmp DISABLE_V8_COMPILE_CACHE=1 \
  NODE_DISABLE_COMPILE_CACHE=1 NODE_USE_ENV_PROXY=0 \
  node node_modules/vitest/vitest.mjs run --execArgv=--use-env-proxy --reporter=verbose

Implementation and automated validation were performed with Codex.

Closes #725