Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@test/cli/install/bun-workspaces.test.ts`:
- Around line 1990-2020: The tests call spawn(...) and immediately assert
expect(await exited).toBe(0) which hides stderr output on failures; update each
spawn call to also destructure and capture stderr (e.g., { exited, stderr } =
spawn(...)), await the stderr content before asserting the exit code, and add an
assertion or include stderr in the failure message (for the spawn invocations
around bunExe(), packageDir and env) so stderr is visible when the process
fails.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@test/cli/install/bun-workspaces.test.ts`:
- Around line 1953-1957: The test case titled "frozen lockfile succeeds in
workspace monorepo with workspace: deps" is a regression test for issue `#19088`
and must be relocated to the canonical regression location; move the test
(including its surrounding describe/context and any fixtures it depends on) out
of test/cli/install/bun-workspaces.test.ts and into a new file named for the
issue (issue 19088), ensure the test file exports/defines the same test name and
preserves any helper imports or setup used by the original (update relative
imports if needed), and remove the original duplicate from
bun-workspaces.test.ts so the test now lives only in
test/regression/issue/19088.test.ts.
- Around line 1958-1985: The test fixture only covers workspace:* dependencies
and misses lockfile-level fields that triggered the regression; update the JSON
written by the write call for the workspace package (e.g., the call that writes
join(packageDir, "packages", "shared", "package.json")) to include a
lockfile-level field such as "trustedDependencies" with at least one entry
(e.g., map a package name to a version or boolean) so the test exercises
recursive diffing of lockfile-level fields like
trustedDependencies/overrides/patchedDependencies and locks the fix; ensure the
added field is valid JSON and placed alongside existing fields like
name/version/dependencies.
- Around line 1998-2000: The test currently asserts
expect(stderr).not.toContain("error") which is too broad and can cause false
failures; update the assertion in the test that reads proc.stderr.text()
(variable stderr) to either remove the broad check entirely and rely on
expect(await proc.exited).toBe(0), or change it to assert absence of the
specific regression message you care about (e.g., the exact error substring
previously observed) so only that exact string is checked rather than any
occurrence of "error".
- Around line 1990-2026: Wrap each Bun.spawn invocation with the resource-safe
pattern using "await using" so spawned processes are disposed correctly: replace
the three raw calls that assign to "proc" (the ones invoking spawn({ cmd:
[bunExe(), 'install' ...] }), spawn({ cmd: [bunExe(), 'install',
'--frozen-lockfile' ...] }), and spawn({ cmd: [bunExe(), 'install',
'--production' ...] })) with "await using proc = spawn(...)" (or equivalent) so
the proc.stderr.text() and proc.exited checks run inside the scope and the
process is cleaned up automatically; ensure you keep references to
"proc.stderr.text()" and "proc.exited" calls inside each using block.