[BUG] Changing `packageExtensions` or `.npm-extension` upgrades locked packages to the newest version in range

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

When the packageExtensions or .npm-extension hash changes, npm re-resolves every extended package from its dependency spec and installs the newest version in range instead of the locked one. This also hits packages whose selector did not change. A manifest-only repair therefore changes installed code (seen in a large monorepo: @tanstack/react-router 1.133.36 to 1.170.36, vite 8.2.2 to 8.3.0).

Expected Behavior

Locked versions that still satisfy their edges are kept; only the extended manifest is refetched.

Steps To Reproduce

mkdir x && cd x
P='"peerDependencies":{"x":"*"},"peerDependenciesMeta":{"x":{"optional":true}}'
echo "{\"dependencies\":{\"abbrev\":\"3.0.0\",\"ms\":\"2.1.2\"},\"packageExtensions\":{\"abbrev\":{$P}}}" > package.json
npm install
echo "{\"dependencies\":{\"abbrev\":\"^3.0.0\",\"ms\":\"^2.1.2\"},\"packageExtensions\":{\"abbrev\":{$P}}}" > package.json
npm install   # up to date
npm ls        # abbrev@3.0.0, ms@2.1.2
echo "{\"dependencies\":{\"abbrev\":\"^3.0.0\",\"ms\":\"^2.1.2\"},\"packageExtensions\":{\"abbrev\":{$P},\"ms\":{$P}}}" > package.json
npm install   # changed 2 packages
npm ls        # expected abbrev@3.0.0, ms@2.1.2; actual abbrev@3.0.1, ms@2.1.3

Same result with .npm-extension.mjs and with install-strategy=linked.

Environment

• npm: 12.0.2 (release and latest c9876d7ea)
• Node.js: v24.18.0
• OS: macOS Darwin 25.6.0

Start by running the minimal package.json reproduction with npm install and npm ls, then trace the npm CLI install path that handles packageExtensions and lockfile reuse. Done means changing packageExtensions or .npm-extension refetches the extended manifest without upgrading locked packages that still satisfy their ranges, including with install-strategy=linked.