fix(cli): honor .npmrc auth keys written without a trailing slash [RED-897] [ship]

[sorccu]

Linear: RED-897

Follow-up deferred from RED-891 (#1444).

Affected Components

• CLI
• Test

What

resolveAuthHeader only probed the canonical slash-terminated nerf dart spellings (//host/path/:_authToken), so a hand-written key without the trailing slash (//host/path:_authToken) was invisible to the walk and embedded-package downloads went out unauthenticated even with the credential right there in .npmrc. Both package managers tolerate the slashless spelling — npm probes both forms at each depth of its walk, pnpm normalises the slashless one to canonical at config load — so the CLI now does too.

nerfDarts() keeps producing only canonical darts (the path form's ${dart}${scope}/ composition relies on the trailing-slash invariant); a small dartSpellings helper expands each finalised lookup candidate — unscoped, scope-qualified, and path-form — into both spellings, canonical first at each depth. The RED-891 scoped/unscoped/path-form ordering logic is untouched.

The AI-context credentials reference documents the accepted spellings accordingly.

Notes for the Reviewer

Behaviour flip worth knowing: a slashless key that was previously ignored is now honored, so one that references an unset ${VAR} now fails the download and names the variable — instead of silently falling through to a shallower working credential (i.e. authenticating as an identity the config asked to replace). A new test pins this deliberately.

Deliberate non-parity at one edge: at the request's own path depth npm probes only the URL's literal spelling, while this walk still tries canonical first there. Only observable with a key at exactly the request's full path — not a key anything writes; documented in the resolveAuthHeader doc comment.

New fixtures cover slashless keys at multiple depths, spelling precedence both ways, blank fall-through to the other spelling, scoped and path forms, no cross-spelling username/_password pairing, and skipUnexpandable tolerance for the slashless path form.

🤖 Generated with Claude Code

[github-actions]

Auto-approved: ship/show PR from a same-repo branch.