Fix flaky npm mirror tarball test

`project_registry_decides_a_mirrors_tarball_urls` (added in #1466)
checks the default-registry fallback, which reads SOCKET_NPM_REGISTRY.
The bun lockb and vlt restore tests set that variable to a mock
server, and they are serial, but this test was not, so it could run
while one of them held the variable and fail. It knocked #1470 out of
the merge queue on the coverage job.

Mark it serial like the other tests that depend on the variable.

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-core/src/patch/redirect/upstream/npm.rs

@@ -4024,7 +4024,10 @@ mod tests {
         );
     }
 
+    // Serial: the default-registry fallback reads `SOCKET_NPM_REGISTRY`,
+    // which the serial bun and vlt restore tests point at a mock server.
     #[test]
+    #[serial_test::serial]
     fn project_registry_decides_a_mirrors_tarball_urls() {
         // A metadata mirror that hands back the project registry's own URLs:
         // the package manager derives them, so they stay out of the lock.