CLI: skip redundant registry probes during sandbox creation

[valentinpalkovic]

Follow-up to #35355 - the product-code half of the angular-create investigation. Sandbox creation spawned ~24 package-manager subprocesses just to resolve versions; most were foregone conclusions.

What

1. latestVersion() short-circuits to the CLI's own versions.ts inside sandbox creation (IN_STORYBOOK_SANDBOX, set by the monorepo task runner, never by real user installs). Verdaccio serves exactly those versions and addPackageResolutions pins them in resolutions regardless, so the per-package registry probe answered a question the CLI already knew. CI specifiers are byte-identical; link-mode local sandboxes get ^version instead of an exact pin (where the linked workspace overrides resolution anyway).
2. addDependencies(skipInstall) stops resolving versions it throws away: it probed the registry serially for every dependency, including ones whose specifier already carried a version (result discarded). Lookups now happen only for unversioned specifiers and run concurrently with deterministic package.json key order. This speeds up real storybook init runs too.
3. getInstalledVersion() reads node_modules/<pkg>/package.json first (plain fs, PnP included) instead of spawning a full dependency-graph walk per package - a walk that exits 1 with clipanion usage output for packages that aren't installed at all (addon-vitest probes vitest/msw/coverage this way on every sandbox). The graph walk remains as fallback for declared dependencies that don't resolve directly (pnpm virtual stores).
4. sb repro skips its latest/next npm probes inside sandbox creation - they only feed the "you are behind" warning copy there and cost two public-registry roundtrips before the template download starts.

Tests

• The four package-manager proxy test suites asserting registry-probe behavior now stub IN_STORYBOOK_SANDBOX off explicitly - the repo-level .env marks every vitest run as sandbox context, which is exactly the environment leak that made these tests catch the change.
• New contract test: inside a sandbox task, latestVersion('storybook') returns the versions.ts version without spawning.
• Full sweep: 1053 tests green across core/common, create-storybook, cli-storybook.

Measured (local timestamped E2E, angular-vite full creation)

	#35355 alone	+ this PR
Version-probe subprocess spawns	24	8 (all non-storybook packages)
Full yarn task sandbox	55.7s	47.5s (baseline before both PRs: 107.3s)
Sandbox tree diff	-	deps + .storybook config identical on the CI path

CI create-job step timings will be posted from this PR's pipeline.

[github-actions]

	Fails
🚫	PR is not labeled with one of: ["qa:needed","qa:skip","qa:success"]
🚫	PR title must be in the format of "Area: Summary", With both Area and Summary starting with a capital letter Good examples: - "Docs: Describe Canvas Doc Block" - "Svelte: Support Svelte v4" Bad examples: - "add new api docs" - "fix: Svelte 4 support" - "Vue: improve docs"
🚫	PR description is missing the mandatory "#### Manual testing" section. Please add it so that reviewers know how to manually test your changes.

	Warnings
⚠️	This PR targets valentin/ci-trim-sandbox-create. The default branch for contributions is next. Please make sure you are targeting the correct branch.

Generated by 🚫 dangerJS against 0ff5d44

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 0ff5d44

Command	Status	Duration	Result
nx run-many -t compile -c production --parallel=8	✅ Succeeded	49s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-07-02 17:59:15 UTC

[valentinpalkovic]

Pipeline status (workflow 9e6c8a83): 80/81 green. The one red job, sveltekit dev, was the EADDRINUSE double-dev-server race (not a version-resolution regression): the dev server held the port but reset the readiness probe's connection mid-startup, so the task spawned a second server that crashed on bind. The fix - treating a held port as ready via a TCP-connect fallback, validated locally against all three socket states - is now commit b933d1a on the base branch (#35355), and this branch is rebased on it.

The create-job version probes measured as expected: the storybook-package yarn npm info spawns are gone from the Create Sandbox logs (only non-storybook packages still resolve against the registry), and the failing yarn info --recursive probes no longer appear in the addon-vitest configure phase.

Status note: HEAD needs one pipeline run before undrafting; the last two triggered pipelines were canceled manually, so I've stopped auto-retriggering. Re-trigger via label toggle or push when ready.

[valentinpalkovic]

HEAD validated green: 82/82 on workflow 069b53d0 (commit 0ff5d44, re-triggered pipeline).

• sveltekit-latest--vite---typescript---dev — the job that flaked with EADDRINUSE last run — passed (213s) with the new TCP-connect fallback in the ready() probe.
• Registry-probe elimination confirmed on this run's step timings: react-vite Create Sandbox 62s (baseline 81–83s), angular-vite 103s (baseline 106–119s).
• No failures, no manual cancellations.

Ready to undraft from my side.

[Ziiyodullayevv]

Good optimization. Skipping redundant registry probes during sandbox creation speeds up the initialization process.