prefetch-npm-deps: use package name field for aliases

npm lockfiles can contain package aliases where the lockfile key differs
from the actual package name (e.g., "string-width-cjs" aliasing
"string-width"). Previously we always used the lockfile key, causing us
to fetch packuments for the wrong package.

Use the package's own "name" field when present, falling back to the
lockfile key. This ensures we fetch the correct packument for aliased
packages, fixing non-deterministic builds where the wrong packument
fetch could succeed or fail depending on network timing.

pkgs/build-support/node/prefetch-npm-deps/src/parse/lock.rs

@@ -25,7 +25,12 @@ pub(super) fn packages(content: &str) -> anyhow::Result<Vec<Package>> {
             .unwrap_or_default()
             .into_iter()
             .filter(|(n, p)| !n.is_empty() && matches!(p.resolved, Some(UrlOrString::Url(_))))
-            .map(|(n, p)| Package { name: Some(n), ..p })
+            .map(|(n, p)| Package {
+                // Use the package's own name if present (for aliases like string-width-cjs -> string-width),
+                // otherwise extract from the lockfile key
+                name: Some(p.name.unwrap_or(n)),
+                ..p
+            })
             .collect(),
         _ => bail!(
             "We don't support lockfile version {}, please file an issue.",