fix(upgrade): use npm pack for historical skeleton extraction in E2E test

[itsjustriley]

WHY are these changes introduced?

The upgrade E2E test (upgrade-e2e.test.ts) extracts historical skeleton templates by checking out a git worktree at past release commits and running pnpm pack. This fails on post-pnpm-migration commits (2026.1.1+) because pnpm pack can't resolve workspace:* and catalog: protocols without an installed workspace (no lockfile, no node_modules).

ERR_PNPM_CANNOT_RESOLVE_WORKSPACE_PROTOCOL  Cannot resolve workspace protocol
of dependency "@shopify/hydrogen" because this dependency is not installed.

PR #3640 attempted to fix this by using pnpm pack in a worktree, but pnpm pack requires a fully installed workspace to resolve protocols — which a bare worktree doesn't have.

WHAT is this pull request doing?

Replaces pnpm pack with npm pack + manual protocol resolution in extractSkeletonTemplate:

• npm pack is protocol-agnostic — it tars whatever is on disk without trying to resolve workspace:* or catalog:. This defines the error out of existence.
• Resolution helpers in upgrade-e2e-utils.ts resolve protocols after extraction by reading workspace package versions and the pnpm-workspace.yaml catalog section from the worktree.
• Handles the workspace:*<version> variant (e.g. workspace:*2026.1.1) seen in some changesets-published releases.
• Pre-pnpm commits (2026.1.0 and older) have no protocols and skip resolution entirely.

HOW to test your changes?

# Unit tests for resolution helpers (19 tests)
cd packages/cli
pnpm vitest run src/lib/upgrade-e2e-utils.test.ts

# Full E2E test (runs against ~8 historical versions)
pnpm vitest run src/commands/hydrogen/upgrade-e2e.test.ts

Checklist

• I've read the Contributing Guidelines
• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've added a changeset if this PR contains user-facing or noteworthy changes
• I've added tests to cover my changes
• I've added or updated the documentation

🤖 Generated with Claude Code

[github-actions]

We detected some changes in packages/*/package.json or packages/*/src, and there are no updates in the .changeset.
If the changes are user-facing and should cause a version bump, run pnpm run changeset add to track your changes and include them in the next release CHANGELOG.
If you are making simple updates to examples or documentation, you do not need to add a changeset.

[fredericoo]

lets go, fair enough!