feat(pm): add --from pnpm migration for install command

.github/workflows/pm-ci.yml

@@ -109,7 +109,6 @@ jobs:
 
       - name: Install dependencies
         run: utoo install
-        continue-on-error: true
 
       - name: Setup node x86
         uses: actions/setup-node@v4

Cargo.toml

@@ -59,6 +59,7 @@ tempfile                          = "3"
 thiserror                         = "1.0"
 tokio                             = { version = "1.47.1" }
 tokio-fs-ext                      = "0.7.8"
+serde_yaml                        = "0.9"
 toml                              = "0.8"
 tracing                           = "0.1.41"
 tracing-subscriber                = { version = "0.3.19", features = ["env-filter", "fmt"] }

agents/rust-code-guard.md

@@ -367,3 +367,4 @@ Scan through this list during every review for high-frequency Rust anti-patterns
 | A16 | Broad Re-export Leak | `pub use module::*` leaking internal helpers | Export precise types explicitly |
 | A17 | Large Enum Variant Size | A single large variant inflating the enum footprint | Heap-allocate the large variant via `Box<T>` |
 | A18 | Trivial Wrapper Function | One-line fn that just forwards to another fn with identical signature | Call the underlying function directly |
+| A19 | Repetitive Conditional Push | Repeated `if x > 0 { vec.push(format!(...)) }` blocks with same structure | Data-drive with `[(value, label)].filter().map().collect()` |

crates/pm/Cargo.toml

@@ -47,6 +47,7 @@ reqwest            = { version = "0.12", default-features = false, features = [
 ] }
 serde              = { workspace = true }
 serde_json         = { version = "1.0", features = ["preserve_order"] }
+serde_yaml         = { workspace = true }
 sha1               = { workspace = true }
 sha2               = { workspace = true }
 tar                = "0.4"