…ity)

- Replace @pnpm/installing.modules-yaml imports in e2e tests with a local
  readModulesManifest that parses .modules.yaml directly. The pnpm v11
  package is ESM and fails with 'Cannot require() ES Module ... because
  it is not yet fully loaded' when Mocha loads multiple test files in
  parallel.
- Drop @pnpm/network.fetch from npm-ci-registry.ts and use the built-in
  global fetch with a local retry loop.

The pnpm v11 packages are ESM, and the `teambit.harmony/envs/core-aspect-env` Mocha
runner in the build capsule fails with "Cannot use import statement outside a module"
when the spec files transitively `require('@pnpm/deps.path' | '@pnpm/lockfile.fs' | '@pnpm/error')`.

Running `bit test scopes/dependencies/pnpm` locally still passes (10/10), so the
coverage isn't lost for local development — just disabled in CI until the capsule
test env supports require() of ESM.

Pnpm v11 (#11189) restricts .npmrc to auth + registry settings only;
hoist-pattern now lives in pnpm-workspace.yaml, so the legacy test
premise no longer applies.

pnpm v11 removed the neverBuiltDependencies install option entirely. Bit's
public API still exposes it, so translate it into the new allowBuilds map
with values set to false. Also ensures dangerouslyAllowAllScripts respects
the blocklist.

pnpm v11's createAllowBuildFunction short-circuits when
dangerouslyAllowAllBuilds is true and ignores allowBuilds entries entirely.
To keep the 'allow all except X' pattern working, skip the flag when a
deny list is present and emit allowBuilds with just the deny entries.

The package is ESM in pnpm v11; loading it through a top-level CJS require()
in the build capsule crashes with 'Unexpected token export'. Dynamic import
bypasses Node's require-ESM machinery and uses the proper ESM loader.

Using new Function('return import(p)') prevents bit's compiler from
rewriting dynamic import() back to require(), so @pnpm/releasing.commands
truly loads through Node's ESM loader rather than require-ESM.

…lude

Exclude @babel/plugin-transform-dynamic-import in both the root babel
config and the aspect env babel config so Babel preserves native
import() in compiled CJS output. This lets packer.ts call
import('@pnpm/releasing.commands') directly instead of going through
the new Function('return import(p)') escape hatch.

Now that babel preserves native import() in CJS output, the inlined
readModulesManifest in three e2e tests and the hand-rolled
fetchWithRetry in npm-ci-registry can be dropped in favor of
await import('@pnpm/installing.modules-yaml') / '@pnpm/network.fetch'
inside the call sites. Type-only imports of Modules stay static
since they're stripped at compile time.

The legacy link is only needed for external repos still importing
`@teambit/legacy`. Since v11 no longer guarantees the package is
installed locally (pnpm-lock no longer carries it), throwing on
require.resolve aborts every install/link in fresh CI workspaces.
Swallow the resolution failure so linking continues.

Three pre-existing dead statements (a `throw` after `return`/`throw` in
each file) only started failing once the post-install oxlint bump from
1.12 to 1.62 enabled stricter `no-unreachable` detection.

Pare back the comments added during the v11 work to keep only the
non-obvious "why" notes — drop what-comments, JSDoc/inline filler in
the auth-config helper, the duplicate ESM justification on packer.ts,
and the empty-catch placeholder in dependency-linker.ts.

The premise — workspace .npmrc options propagating into capsule installs —
no longer applies under pnpm v11, and bridging this through pnpm-workspace.yaml
isn't worth supporting. Drop the test and the pnpmWorkspaceConfig helper hook
added for the rewrite attempt.

…best-effort"

This reverts the relevant change from e6ca4a7 and the comment touch-up
in b5a5332. The original CI failure was diagnosed before later fixes
landed and was not reproduced afterwards, so swallowing the error here
masked symptoms without addressing the root cause.

…ompat"

This reverts the spec deletions from 9fa93e8. Node 22's native
require(esm) lets the capsule's mocha runner load the transitive
ESM-only @pnpm/* deps without any wrapping; bit test runs all
12 specs successfully.

…ipping on ESM)

Local bit test passes on Node 22 thanks to require(esm), but the
core-aspect-env mocha capsule on CI still throws "Cannot use import
statement outside a module" on the same Node 22.22 image. The spec's
top-level import of `./lockfile-deps-graph-converter` triggers the
chain unconditionally, so describe.skip does not help — drop the spec
again until the prod module's ESM-only @pnpm/deps.path and
@pnpm/lockfile.fs imports get pushed through a .cjs shim.

Keeps pnpm-error-to-bit-error.spec.ts which only references
@pnpm/error via a type-only import.

The capsule mocha-tester pins @babel/register@7.18.9 (2022), whose
require hook trips Node's require(esm) path on transitive
@pnpm/deps.path / @pnpm/lockfile.fs loads. Forcing ^7.28 via
workspace.jsonc overrides applies the rewritten compile/worker
implementation, which preserves the require(esm) flow for ignored
paths. Restore the spec so CI can verify; bit test passes locally
with the override (12/12).

@pnpm/config.reader@1101.2.0 exposes the helpers pnpm itself uses to
turn a flat npmrc-style auth dict into the configByUri map. Drop the
local port (authConfigToConfigByUri + decodeBasicAuth) and call the
upstream functions directly so the parsing stays in lockstep with
pnpm — including basicAuth decoding, SSL key/cert/file handling, and
default-registry creds keying.

The @babel/register@^7.28 override in workspace.jsonc only applies to
the bit workspace install; the env capsule that runs MochaTest installs
its own deps from @teambit/defender.mocha-tester (which pins
@babel/register@7.18.9), so the override never reached the failing
runner. Newer @babel/register also still trips on the transitive
require(esm) chain in CI.

Removing both the override and the lockfile spec, leaving the small
pnpm-error-to-bit-error.spec.ts which is unaffected. Restoring the
spec needs a fix in @teambit/defender.mocha-tester (or a capsule-level
override mechanism).

…tern

Move the @pnpm/deps.path and @pnpm/lockfile.fs imports behind an exported
async init() that loads them through a .cjs shim so the build capsule's
mocha runner doesn't trip on the transitive ESM require chain. Helpers
keep using module-level slots synchronously, so convertLockfileToGraph /
convertGraphToLockfile and all internal helpers stay sync in shape.

Callers (pnpm.package-manager.ts:calcDependenciesGraph and
dependenciesGraphToLockfile) await init() once. The spec adds a single
top-level before(init) plus a small before() in the simple-case describe
that needed to defer its describe-body-level convertLockfileToGraph call
until after init runs. bit test passes 12/12 locally.