test(pm): validate package-lock JSON in arborist e2e

e2e/pm-arborist.sh

@@ -49,6 +49,22 @@ clean_fixture() {
   find "$dir" -mindepth 2 -name "node_modules" -type d -exec rm -rf {} + 2>/dev/null || true
 }
 
+# Validate package-lock.json is well-formed JSON, if present.
+# Returns 0 when no lockfile exists or it parses; 1 + fail() on bad JSON.
+# On bad JSON, echoes the underlying parse error so the failing fixture is
+# easy to diagnose without re-running node manually.
+validate_lockfile() {
+  local name="$1"
+  [ -f "package-lock.json" ] || return 0
+
+  local err
+  if ! err=$(node -e "try{JSON.parse(require('fs').readFileSync('package-lock.json','utf8'))}catch(e){console.error('JSON.parse: '+e.message);process.exit(1)}" 2>&1); then
+    fail "$name (invalid package-lock.json)"
+    echo -e "      ${DIM}$err${NC}"
+    return 1
+  fi
+}
+
 # ----------------------------------------------------------------
 # Known-skip lists: features utoo PM does not yet support.
 # See e2e/pm/arborist/README.md for details.
@@ -178,6 +194,7 @@ test_install_success() {
 
   if utoo install $flags 2>&1; then
     if [ -d "node_modules" ] || [ -f "package-lock.json" ]; then
+      validate_lockfile "$name" || return
       pass "$name"
     else
       local dep_count
@@ -237,6 +254,7 @@ test_install_optional_graceful() {
   clean_fixture .
 
   if utoo install 2>&1; then
+    validate_lockfile "$name" || return
     pass "$name ($desc)"
   else
     fail "$name (should succeed despite optional dep issue: $desc)"
@@ -310,6 +328,7 @@ if should_run "testing-peer-dep-conflict-chain" && [ -d "$ARBORIST_DIR/testing-p
       cd "$sub"
       clean_fixture .
       if utoo install 2>&1; then
+        validate_lockfile "testing-peer-dep-conflict-chain/$subname" || continue
         pass "testing-peer-dep-conflict-chain/$subname"
       else
         fail "testing-peer-dep-conflict-chain/$subname"
@@ -710,6 +729,7 @@ for name in \
     elif [ -d "$dir/node_modules" ]; then
       cd "$dir"
       if utoo install 2>&1; then
+        validate_lockfile "reinstall-$name" || continue
         pass "reinstall-$name"
       else
         fail "reinstall-$name (second install failed)"

e2e/pm/arborist/README.md

@@ -133,7 +133,7 @@ npm/cli's arborist tests use multi-layered assertions:
 - Add expected version checks for 15–20 key fixtures (peer-deps, dedup,
   workspace variants) using `node -e "require('./node_modules/pkg/package.json').version"`
 - Verify expected packages exist (and unexpected ones don't) in `node_modules/`
-- Validate `package-lock.json` is valid JSON
+- Validate generated `package-lock.json` is valid JSON (implemented in `e2e/pm-arborist.sh`)
 
 **Phase 2 — tree snapshots & error validation:**
 - Snapshot `utoo ls --json` output and compare against baselines