fix(dev): Windows-proof the Pi patch checks and fork test paths

[yexisu]

Problem

Two Windows-only dev-environment failures from #1361 (Linux CI unaffected):

1. check:pi-dependencies / check:pi-patches detect pnpm's patched instance by matching the literal patch_hash= segment in realpathSync output. Windows shortens .pnpm store directory names (long-path limit), the segment disappears, and both checks misreport a healthy install.
2. native-pi-session.test.ts "never deletes a foreign publication" compared foreignPath.split("/").at(-1) with readdirSync output; on Windows the split never breaks the path, so an absolute path was compared against a bare file name.

Fix

1. The patch hash is now proven through the lockfiles instead of path strings: the root pnpm-lock.yaml patchedDependencies entry declares the 64-hex hash for name@version, and node_modules/.pnpm/lock.yaml must embed that hash in the installed snapshot's version: <v>(patch_hash=...) line. This survives Windows's shortened directories, is stricter than the old substring match, and is unchanged on Linux. The installed manifest is still version-checked directly via realpath.
2. foreignPath.split("/").at(-1)! replaced with basename(foreignPath).

Validation

• The fork test now passes on Windows (failed on pristine main): native-pi-session.test.ts targeted run 1/1
• Two-stage hash chain verified against this machine's lockfiles: the declared 1.0.1 hash resolves from pnpm-lock.yaml, and the stale 0.99.1 virtual-store snapshot correctly fails the embed check (proving the check is strict)
• Full check:pi-* end-to-end run requires a 1.0.1 install this machine does not have yet; logic verified as above, CI covers the rest

Fixes #1361

[yexisu]

Rebased onto current main (c5a16e9aa, includes #1371/#1372) and force-pushed (a7e393bc5). The Windows fork-path test this PR fixes now passes on the rebased head (native-pi-session.test.ts targeted run 1/1); note it still fails on current main itself, which is exactly the baseline defect being fixed here. Ready for a landing review.

[vastsa]

Thanks for contributing the Windows portability fixes. The issue is real, and #1363 now covers both the patch-check and path-test failures with a seven-case shortened-store regression suite; its CI passed and it has merged. Closing this duplicate as superseded.