feat(cli): embed private dependency tarballs into Playwright code bundles [RED-855]

[sorccu]

Linear: RED-855

What

Adds a checks.embeddedPackages config option that embeds npm registry tarballs into the Playwright Check Suite code bundle at .checkly/embedded-packages/*.tgz, so runners can install packages they cannot fetch themselves (e.g. from a private registry that is only reachable from the customer's network). The runner half that serves the embedded tarballs through a local registry during install is a separate change (RED-856); do not cut a CLI release containing this feature before that runner support is deployed.

How

Three commits, one per layer (plus follow-ups: platform-independent npm-cache tests for Windows CI, and moving the tarball cache to node_modules/.cache/checkly):

1. Config option — checks.embeddedPackages?: string[] (package names embed every lockfile version; name@version pins an exact version), with runtime shape validation at config load and plumbing through ProjectParseOpts → Session for deploy/test/validate/pw-test/parse-project.
2. Services (src/services/embedded-packages/) — lockfile enumeration (pnpm-lock.yaml v6/v9, package-lock.json v2/v3, with precise reasons for git/file/workspace/integrity-less entries), .npmrc parsing with scope-aware registry resolution, nerf-dart auth matching and npm_config_* env layering, SRI integrity helpers, and a content-addressed per-user tarball cache with a read-only npm-cache (cacache) lookup tier.
3. Wiring — a memoized session-level materializer shared by validation and bundling; project validation resolves the configured entries against the lockfile before any bundling (grouped fatal diagnostics); Playwright bundling appends the verified tarballs at the contract path via explicit archive paths, independent of workspace layout.

Tarballs are always the verbatim registry artifact, verified against the lockfile's integrity hash, sourced through CLI cache → npm cacache → registry download (proxy-aware via the existing assignProxy helper, credentials redacted from errors). Downloads are cached under the workspace root's node_modules/.cache/checkly (persisted automatically by CI setups that cache node_modules; a per-user cache dir is the read/write fallback; CHECKLY_CACHE_DIR overrides), so nothing user-visible lands in the project outside node_modules. The pnpm store cannot serve as a source because it retains only unpacked per-file blobs, not original tarballs.

Deliberate v1 limits (documented; follow-ups tracked in Linear): only explicitly listed packages are embedded (no auto-detection, including transitive private deps), no wildcard entries, no yarn/bun lockfiles, .npmrc proxy/cafile/strict-ssl keys not honored (proxy env vars work).

Testing

• 110+ new unit tests (spec parsing, npmrc/registry/auth, lockfile enumeration, cache, materializer against a local HTTP registry covering auth, integrity mismatch, cache tiers).
• Offline integration tests: fixtures with committed deterministic tarballs pre-seeded into a temp CHECKLY_CACHE_DIR assert the archive contains the contract paths (including subdirectory Playwright configs and version-pin filtering) and that a package missing from the lockfile fails validation.
• Full suite: 1910 passed. Manual smoke test against registry.npmjs.org: bundled tarball byte-identical to the lockfile integrity; warm-cache re-run skips the download.

🤖 Generated with Claude Code