Add `e2e_redirect_yarn_berry_build.rs` and `e2e_redirect_bun_build.rs`,
the hosted-mode (`scan --mode hosted`) full-chain analogs of
`e2e_redirect_npm_build.rs` for the yarn-berry and bun flavors:
`scan --mode hosted` rewrites the lock to resolve the patched dep from
the wiremock hosted tarball, then a fresh-checkout install
(`yarn install --immutable --check-cache` / `bun install
--frozen-lockfile`, offline from the registry) MUST land the patched
bytes; a tamper twin serving different bytes must fail (YN0018 /
integrity).

berry derives the exact `10c0/<hex>` cache-zip checksum the mock hands
back by a bootstrap real-yarn `resolutions: file:` install (yarn
recomputes the same zip checksum for the archiveUrl locator). Two
harness robustness measures: the corepack gate probes from a neutral
tempdir (the monorepo root's `packageManager` field otherwise makes
corepack refuse yarn), and every yarn invocation sets
`YARN_ENABLE_GLOBAL_CACHE=false` so the persistent `~/.yarn/berry`
cache can't serve the tampered twin honest bytes.

`bun.lockb` migration is not exercised here (bun 1.3.x has no flag to
emit the binary lockfile); it stays covered by the in-process shim test
`scan_redirect_migrates_bun_lockb_then_redirects`.

Assisted-by: Claude Code:claude-fable-5