install: key npm cache entries by their integrity, derive URL-based cache names with SHA-256 - #37756

The `.id` file is opened with mode `0o644` here, but the PR description says "created (`O_EXCL`, mode 0600)" and the test-harness twin `installCacheFolderName` in test/harness.ts writes it with `{ flag: "wx", mode: 0o600 }`. The security impact is negligible (the id is only a keying salt), but the three sources should agree — either change this to `0o600` or update the description and harness.

The doc comment says "if the file cannot be read or created at all the key falls back to zeroes so names stay stable", and the `Err(_) => return [0; 16]` arms honour that — but the loop-exhaustion fallthrough here calls `rand_bytes(&mut id)` and returns fresh random bytes instead. Reachable via 3× `Ok(0) => continue` or 3× ENOENT-then-EEXIST races; two processes that both hit it get different ids and orphan each other's fingerprinted entries, which is what the zero fallback is meant to prevent.