> This doesn't work if the pulls are happening in swarms of ephemeral sandboxes.

This is incorrect.

It actually will work if you mount a drive. Github mirrors can be on separate drives. Now I haven't fully tested it's safety in that situation yet, like I have with local dev on Windows and MacOS.

> Also, maybe FUD, but is there anything useful to learn from (p)npm other than cautionary tales?

This is also incorrect.

Denigrating pnpm's well regarded optimizations because NPM packages have vulnerabilities unrelated to NPM is missing the point.