Consider unifying cache verification for modern Yarn #3137

Vite+ no longer depends on Corepack, but it still supports integrity pins that Corepack writes to the packageManager field.

For Yarn 2 and later, these pins cover bin/yarn.js, not the npm tarball. Changing the hash target would break existing valid pins, as previously reported in #2209 and fixed in #2227.

Could we use a common cache verification policy for all package managers? When the verification record is missing or differs from the requested pin, Vite+ would download, verify, and replace the installation instead of rehashing the cached Yarn CLI.

Modern Yarn would still verify the extracted bin/yarn.js to preserve existing pin compatibility. This would require network access in cases where local verification currently works.