Fix flaky npm mirror tarball test

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Refs #1470

What failed

#1470 was dequeued from the merge queue because the coverage job
failed (run 38408989500). The failure was in a core test that #1470 doesn't
touch:

patch::redirect::upstream::npm::tests::project_registry_decides_a_mirrors_tarball_urls
panicked at crates/socket-patch-core/src/patch/redirect/upstream/npm.rs:4072:9:
assertion failed: registry_derives_tarball(Some("https://r.example/npm"), false, "a", "1.0.0",
    "https://registry.npmjs.org/a/-/a-1.0.0.tgz")

Root cause

The test came in with #1466. The assertion that fails checks the
default-registry fallback, which calls npm_registry_base() and so reads
SOCKET_NPM_REGISTRY. The bun lockb and vlt restore tests in the same
crate set that variable to a mock server. They are #[serial_test::serial],
but this test was not, so it could run while one of them held the
variable.

Evidence:

• With SOCKET_NPM_REGISTRY=http://127.0.0.1:9/mock, the test fails on
  the same line every time, and passes without it.
• main itself is green (coverage passed on 501c6d9 and 4221796), so
  the failure only appears when the scheduling lines up.

Fix

Mark the test #[serial_test::serial], like the other tests that depend
on the variable. With the variable set, the only other non-serial
reader in the npm and upstream test modules was
bun_writes_the_tarball_url_unless_it_is_on_npmjs, and that test is
already serial.

Tests

• cargo fmt --all -- --check: clean
• cargo clippy -p socket-patch-core --all-features -- -D warnings: clean
• cargo test -p socket-patch-core --lib patch::redirect::upstream: 146/146,
  25 repeated runs clean. The race didn't reproduce in 25 runs without the
  fix either, because its window is small outside the coverage build.

🤖 Generated with Claude Code

https://claude.ai/code/session_011KEL5sGU2JuwHvDCpJtMwi

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 9f88174. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[agent] Closing as redundant. #1484 (285a5e8) already landed the same fix on main: project_registry_decides_a_mirrors_tarball_urls is now #[serial_test::serial], with a matching comment. That is also why the merge queue reported a conflict. #1470 merged on its re-queue, so nothing else is waiting on this.

---

Generated by Claude Code