Use version-pinned PyPI metadata to resolve prerelease sub-dependencies correctly

[Copilot]

Installing a prerelease root package (e.g. jupytergis-lite==0.16.0a0) could still pull stable sub-dependencies (0.15.0) because dependency metadata was read from the unversioned PyPI endpoint. This change makes sub-dependency resolution follow the exact selected package version metadata.

• Dependency metadata source

  • In processRequirement, after selecting solved.version, fetches:
    • https://pypi.org/pypi/{package}/{version}/json
  • Uses that version’s info.requires_dist when present, instead of relying on unversioned package metadata.

• Fallback and robustness

  • Keeps existing unversioned metadata as fallback when version-specific fetch fails.
  • Encodes package/version path segments and checks HTTP response status before parsing JSON.
  • Emits a warning when falling back, preserving current behavior while making failures visible.

• Regression coverage

  • Adds a focused test in unittests/tests/pip/test-solver.ts for:
    • jupytergis-lite==0.16.0a0
  • Asserts transitive resolution selects:
    • jupytergis-core==0.16.0a0
    • jupytergis-lab==0.16.0a0

const versionResponse = await fetch(
  `https://pypi.org/pypi/${encodeURIComponent(requirement.package)}/${encodeURIComponent(solved.version)}/json`
);
const versionMetadata = await versionResponse.json();
const versionRequiresDist = versionMetadata?.info?.requires_dist as string[] | undefined;

if (versionRequiresDist?.length) {
  requiresDist = versionRequiresDist;
}

[martinRenou]

@copilot please undo yarn.lock changes, you're using a different yarn version than us, I use 4.12.0

[Copilot]

@copilot please undo yarn.lock changes, you're using a different yarn version than us, I use 4.12.0

Done in commit 9e933c3: yarn.lock has been reverted to the baseline version so the PR no longer includes lockfile changes from a different Yarn version.