Fix FIFO hang in npm v4 lockfile package.json read

Replace bare std::fs::read_to_string with read_regular_to_string_sync in
has_native_patch to prevent indefinite blocking on FIFOs or device files
planted at package.json path. The guard uses O_NONBLOCK open + fstat
regular-file check, matching lockfile reads in select_lockfile and other
package.json readers throughout the npm vendor stack.

Author: cursoragent

crates/socket-patch-core/src/vendor/npm_lock.rs

@@ -22,7 +22,7 @@ use serde_json::Value;
 use crate::constants::SOCKET_DIR;
 use crate::manifest::schema::PatchRecord;
 use crate::patch::apply::PatchSources;
-use crate::utils::fs::{atomic_write_bytes_preserving_mode, read_regular_to_bytes};
+use crate::utils::fs::{atomic_write_bytes_preserving_mode, read_regular_to_bytes, read_regular_to_string_sync};
 use crate::utils::socket_dir::remove_tree_and_prune;
 
 use super::common::{parse_json_manifest, refused, JsonLayout};
@@ -487,7 +487,7 @@ fn lock_version_gate(
 /// `patchedDependencies` key, or a non-null `patched` record on a lock
 /// entry. Only the refusal path calls it, so the blocking read is rare.
 fn has_native_patch(lock: &Value, project_root: &Path) -> bool {
-    let manifest = std::fs::read_to_string(project_root.join("package.json")).ok();
+    let manifest = read_regular_to_string_sync(&project_root.join("package.json")).ok();
     if !super::bun_lock_text::patched_dependency_keys(manifest.as_deref(), None).is_empty() {
         return true;
     }