fix(ci): name Yarn tarball requests and reproduce hidden-path resolution

[canblmz1]

Cause and fix

The previous fixture-only resolution mapping was insufficient: Yarn Classic derives dependency ancestry from the raw request, and the hidden .tautest path prevents resolution glob matching. Name both local package requests to retain package identities during resolution.

Real verification

• Built and packed exact PR chore: version packages #32 sources without production manifest edits: old command failed; named requests installed the same unpublished 2.0.6 tarballs and the real CLI printed 2.0.6.
• Add an offline real-Yarn regression executing the workflow's actual shell with unpublished fixture tarballs, a hidden directory, spaces, and an empty cache. Negative control fails with the old command.
• Local build, lint, typecheck, full tests and 45 focused tests pass (Node 24.19.0, Yarn 1.22.22).

Only readiness workflow and tests change. Original actual-package smoke remains mandatory; no package versions, production dependencies, publishing commands, permissions or credentials change. Exact-head CI and then refreshed #32 unpublished-version CI remain required before publication.

AI-assisted maintenance for Can. Follows #34; related #32.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.