[lazerg]

With a registry served under a path like http://localhost:3080/npm/, a lockfile entry for the package named npm gets its tarball rewritten from https://registry.npmjs.org/npm/-/npm-11.19.1.tgz to http://localhost:3080/npm/-/npm-11.19.1.tgz, so the fetch 404s. The host-only branch of #registryResolved skips adding the registry path when the resolved path already starts with it, and /npm/-/... passes that check even though /npm is the package name here. #8737 fixed names that start with the path (npm-run-path) but not an exact match.

I kept the "already has the path" check, since replace-registry-host=always relies on it when moving between two hosts that share a path (the "registry with path should only swap hostname" test). It's just skipped for registry.npmjs.org, which never serves under a path, so the path is always added there.

Testing

Added a test next to the #8737 one with the registry path equal to the package name and a registry.npmjs.org tarball. It fails before the change and passes after. The arborist suite passes locally with full coverage.

References

Fixes #10159