[Aschenbath]

Custom registries with missing signing metadata can currently fail with low-level errors such as integrity.slice and an unhandled verification rejection. Await signature verification before caching an installation, clean up failed downloads, and report package-specific usage errors for missing/malformed metadata, untrusted keys, invalid key configuration, and signature failures.

Add an integrity guide linked from verification/hash errors and the README. It covers tampering risks, troubleshooting, the COREPACK_INTEGRITY_KEYS JSON format, and the empty-string opt-out. The existing 0 opt-out and pinned-hash checks remain supported. Latest-version failures retain the underlying reason and point to the guide instead of immediately recommending disabling verification.

Validation:

• Full Vitest suite in replay mode on Node.js 24.20.0: 8 files passed; 208 tests passed and 1 existing expected failure (209 total).
• TypeScript typecheck and ESLint (--max-warnings=0) passed.
• Build passed.
• Regressions cover unsigned/malformed registry metadata, invalid and untrusted keys, asynchronous package-root signature fallback, repeated rejection without caching/execution, and both supported opt-out values.

Closes #570

[aduh95]

This account has opened more than 10 PRs in the last 24 hours. This looks like bot activity, and will result in a ban if the behavior continues.