[jeffwidman]

Summary

• make Shrinkwrap#get() prefer current packages data, then metadata from the attached live tree, before falling back to legacy lockfile data
• resolve the requested path once while using Shrinkwrap-relative coordinates for lockfile maps and tree.root.realpath coordinates for live inventory lookups
• keep add() hydration on persisted metadata so an incomplete node cannot mask legacy resolved or integrity values
• cover linked top-of-tree paths, colliding inventory locations, lookup precedence, non-caching live lookups, and legacy hydration

Design choice

The existing Arborist README describes node.meta as looking up resolved and integrity values for all modules in the tree. This change treats an attached tree as part of that lookup contract rather than returning stale legacy metadata when the modern packages entry is absent.

That is an API/behavior choice for maintainer discussion, not an assumption that the implementation must change:

tightening the documentation instead would be a valid alternative if live-tree fallback is not the intended contract.

This is the standalone bug-fix portion split from #10130. It intentionally excludes the v3+ legacy traversal and serialization optimization so the two decisions can be reviewed independently.

Testing

• tap --no-coverage test/shrinkwrap.js test/node.js
• eslint lib/shrinkwrap.js test/shrinkwrap.js
• mutation checks confirmed the new regressions fail when live lookup is removed and when add() uses live lookup during hydration
• git diff --check