Native install: --only-missing local dependencies create duplicate package entries

Refs #66, #709.

A real local dependency control exposes malformed package metadata in both Home and the pinned Bun executable (4982b91). This shared failure is not accepted as passing logical parity.

Reproduction: create two local folders with the same package name and versions 1.0.0 and 2.0.0. The project initially depends on file:../dependency-one. Run --only-missing install, then --only-missing install -- file:../dependency-two, then add an unrelated local dev dependency, then --silent remove leading-flag-dependency. The second install exits zero but writes duplicate leading-flag-dependency keys with both folder paths into package.json and bun.lock. Remove subsequently exits one with Duplicate package path.

Home source: 9e1656f7c3cd4b76200819e88a630f09b028e5c7; executable SHA-256 5e7a26d1b366fad80626c7ff19052d119cb19235b84f15a8f85378e49bb4f3ed. Bun control SHA-256 47a87c1dea30da59c2733cce80118ea59bd338c616c6378f1c7f55e5f2b92c87. The original logs and fixtures were under zig-out/bun-port-709/leading-flags-verification/, but were lost when that worktree disappeared on September 8. Committed summaries and the recorded hashes survived. A fresh native reproduction on source 6053c6c again captures the duplicate keys directly in local-identity-before.log; see the current checkpoint comments and retained evidence.

The original private control checked parsed JSON, which collapses duplicate keys; its earlier ok fields are insufficient evidence of metadata integrity. The raw artifacts and final failing remove are authoritative.

Investigate identity resolution in PackageManager/PackageJSONEditor.zig: non-aliased local requests use the literal path through getName() before resolution, while new keys use getResolvedName(). Fix the actual edit/install lifecycle so an existing package is preserved by --only-missing, with no duplicate keys or inconsistent lockfile. Add a regression that rejects duplicate JSON keys and verifies a subsequent install/remove succeeds. No deleting lockfiles, bypassing validation, source rewriting, or retry-based acceptance.

Native package repair batch in progress; all source changes are pushed to origin/main through 24bdc3e.

• #713 is reproduced again on the actual 6053c6c executable. The new regression inspects raw package.json and catches both duplicate keys directly, rather than accepting JSON.parse's last-key result. Local folder names are now resolved before the first package edit, and multiple paths naming the same package retain the existing first-request precedence. Coverage includes all dependency groups, path forms, explicit aliases, normal replacement, later frozen install/remove, and workspace-relative arguments.
• New #716 tracks native update/outdated activation. The actual native-mode outdated command previously reported all packages up to date even after a local registry published a newer version. Both commands now route to Home's owned runtime implementations. The regression checks registry discovery, real gzip/integrity-checked archives, ordinary and --latest upgrades, interactive acceptance/decline, and installed contents.
• Production compilation exposed missing public command exports and unported interactive I/O/rendering. Those first build failures are retained. The command exports, stdin and manifest-file I/O, version writers, and synchronized terminal frame rendering have been ported; the next build is underway. Neither issue is accepted as fixed until the actual native batch passes.

The earlier #713 raw fixture directory was lost in the previously reported worktree incident; its issue body now explicitly states that instead of claiming it still exists. Fresh logs remain outside disposable worktrees, and completed results will be committed with the checkpoint. No upstream test or snapshot has been altered, no frozen validation removed, and no package operation delegated to Bun.

Verified and fixed in Home. Native runtime source 6a183ad built successfully (46/46 steps); executable SHA-256 4401f12d1335d21039cd2a796a1a86b12331c9ddd0c64f4eaaea57957a5713d6.

The corrected native-local-dependency-identity regression passes the four dependency groups × three folder argument forms, unrelated dev additions, frozen validation, removal, ordinary replacement, duplicate local requests, explicit aliases, and workspace-relative names. It checks raw package.json key counts and actual installed versions. The first workspace check had an incorrect root-hoisting assumption; a retained Home/Bun comparison established that these folder packages belong in the workspace's own node_modules, and the assertion was corrected in a6d65e2. This was a fixture correction, not a runtime workaround.

The same comparison reproduces the actual duplicate metadata/frozen-lock failure in pinned Bun. Home preserves the original single dependency and its 1.0.0 contents and passes the subsequent frozen install. Shared upstream breakage is not treated as success. The fix resolves local package identity before either the package edit or graph mutation, preserving --only-missing semantics without deleting lockfiles or repairing duplicate JSON afterward.

Full logs, both test-source revisions, comparison manifests/symlink trees, and original fixture archive are committed under docs/docs/bun-port-evidence/2026-09-08-native-package-verification/ in 5e1d775. The two temporary diagnostic fixtures were removed after archival. #716 continues separately for native outdated output; #66 and #709 remain open for the wider port.