fix(yarn): patch yarn.lock for link: dependencies and fix extraction path

[leodido]

Description

This PR adds support for yarn packages that use link: dependencies in monorepo setups when building with --frozen-lockfile.

Fixes https://linear.app/ona-team/issue/PDE-180/build-failures-with-frozen-lockfile

Problem: link: dependencies break with --frozen-lockfile

Yarn's link: protocol references local packages via relative paths (e.g., "shared-lib": "link:../shared"). These paths are relative to the source directory, but leeway builds run in an isolated build directory where those paths don't exist.

Before --frozen-lockfile was introduced, yarn install would resolve these broken paths and update the lockfile. After introducing --frozen-lockfile (commit 3bf13c6), yarn refuses to install because the lockfile doesn't match the actual dependency resolution.

Solution

When building a yarn package that has link: dependencies on other leeway yarn packages:

1. Extract the dependency to _link_deps/<pkg>/ in the build directory
2. Patch package.json to replace link:../path with file:./_link_deps/<pkg>
3. Patch yarn.lock to match the patched package.json (required for --frozen-lockfile)

Tarball structures

Leeway produces two types of yarn tarballs depending on the packaging config:

• YarnLibrary (packaging: library, uses yarn pack):

  package/
  package/package.json
  package/index.js
  

• YarnApp (packaging: archive, default):

  ./node_modules/<pkg-name>/
  ./node_modules/<pkg-name>/package.json
  ./node_modules/<pkg-name>/...
  

The extraction uses --strip-components with an explicit path filter to handle each case:

• YarnLibrary: tar -xzf $tarball -C _link_deps/$pkg --strip-components=1 package/
• YarnApp (non-scoped): tar -xzf $tarball -C _link_deps/$pkg --strip-components=3 ./node_modules/$pkg/
• YarnApp (scoped, e.g., @scope/pkg): tar -xzf $tarball -C _link_deps/$pkg --strip-components=4 ./node_modules/@scope/$pkg/

Implementation details

• Added extractNpmPackageNames() to discover npm package names from built tarballs (needed because leeway package names like shared-lib:lib don't match npm names like gitpod-shared)
• Handle path normalization differences between package.json and yarn.lock (e.g., link:./../shared vs link:../shared)
• Handle scoped npm packages (e.g., @gitpod/utils) which have an extra path component in the tarball structure

Changes

• pkg/leeway/build.go: Add link: dependency handling for yarn packages
• pkg/leeway/build_internal_test.go: Add unit tests for scoped package extraction
• pkg/leeway/build_integration_test.go: Add integration test

Testing

Added integration test TestYarnPackage_LinkDependencies_Integration that:

1. Creates a monorepo with shared-lib and app packages
2. app depends on shared-lib via link:../shared-lib
3. Verifies the build succeeds with --frozen-lockfile

Added unit test TestYarnAppExtraction_ScopedPackage that verifies:

1. Non-scoped packages extract correctly with --strip-components=3
2. Scoped packages (e.g., @test/utils) extract correctly with --strip-components=4

Also tested manually with gitpod-next vscode packages:

leeway build frontend/vscode/remote:package --dont-test -Dversion=0.0.1
leeway build frontend/vscode/desktop:package --dont-test -Dversion=0.0.1

Both builds succeed with this PR.

[geropl]

✔️ to unblock