v0.55.1

fix: keep stubs when linking would change a binary's env (#636)

Since v0.54.0, activated shells run package binaries straight from the
link farm, without their `bin/` stubs. A stub applies its own package's
environment variables last, so they take precedence. A linked binary
only sees the shell's merged environment, where the last package to set
a variable wins. This broke squareup/cash-server#142281: several tool
packages each set `CASH_SERVER_TOOLS_HOME` to their own root, so all but
one launched with another package's root and failed to find their JAR.

The link farm should only bypass a stub when doing so cannot change what
the binary sees. This PR adds three conditions:

- **Overridden variables.** A package is linked only if its stub would
run it with the same environment the shell already has. Otherwise it
keeps its stub. Differences only in the order of `:`-separated lists
such as `PATH` are ignored, because stubs move their package's entries
to the front but never drop any. Without this, any package that adds to
`PATH` would lose its link whenever a later package also adds to `PATH`.
- **Requirements that are not unpacked.** A stub unpacks everything its
package declares in `requires` before running it. A linked binary may
reach those packages through variables such as `JAVA_HOME` rather than
through their stubs. For example, after a pull bumps the JDK, a linked
Maven would find `JAVA_HOME` pointing at a directory that does not exist
yet. Such packages now keep their stubs until the next activation after
their requirements are unpacked.
- **Children of unactivated stubs.** A stub run outside an activated
shell adds the link farm to its binary's `PATH`. If that stub changes
any variable relative to the activated environment, through overridden
variables, runtime dependencies or a bundled Hermit environment, it now
leaves the link farm off. Its children then go through their own stubs
and get their own values. In activated shells this already happened,
because stubs put `bin/` back ahead of the link farm.

Link farms are still never modified once created. A package that becomes
unsafe to link is simply left out of the next farm.

New integration tests cover each condition, and each fails without its
fix.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>