install: key npm cache entries by their integrity, derive URL-based cache names with SHA-256 - #37756

The `Ok(0) => continue` arm never unlinks or falls through to the `O_CREAT|O_EXCL` block, so a persistently 0-byte `.id` (process killed between the exclusive create and `write_all`) is never repaired — every later process reads `Ok(0)` three times and falls through to a per-run `rand_bytes` key, so fingerprinted cache entries never hit and orphans accumulate. On the final iteration treat `Ok(0)` like the `Ok(_)` truncated case (unlink and fall through), or write to a temp name and `renameat` so