Cache the metadata directory reported by pnpm cache path

Problem

pnpm 11.22.0 added pnpm cache path, which reports the metadata cache directory. The release notes explicitly recommend caching this directory in CI because it includes the lockfile verification log and lets an unchanged lockfile skip repeated supply-chain policy checks.

pnpm/setup currently restores and saves only the directory returned by pnpm store path when cache: true:

https://github.com/pnpm/setup/blob/main/src/cache-restore/run.ts#L40-L44

As a result, the content-addressable package store is cached, but the separate metadata cache is not. Projects using settings such as minimumReleaseAge or trustPolicy must repeat registry-backed lockfile verification on later CI runs even when the lockfile is unchanged.

Proposed behavior

When cache: true:

• Restore and save both pnpm store path and pnpm cache path.
• Preserve compatibility with pnpm 11.0–11.21 by gracefully falling back to store-only caching when pnpm cache path is unavailable.
• Keep the existing cache key behavior unless separate store and metadata keys are preferable.

An opt-in input for metadata caching would also work, although including it by default appears consistent with pnpm 11.22's CI guidance.

References

• pnpm 11.22.0 release notes: https://github.com/pnpm/pnpm/releases/tag/v11.22.0
• Current cache implementation: https://github.com/pnpm/setup/blob/main/src/cache-restore/run.ts#L40-L44

Environment

• pnpm/setup v2.0.2 and current main
• pnpm 11.22.0

Start in src/cache-restore/run.ts around lines 40–44 and read the pnpm 11.22.0 release notes, then trace the existing restore/save flow and cache-key handling. Done means cache:true includes both pnpm store path and pnpm cache path when available, while pnpm 11.0–11.21 fall back gracefully to store-only caching without breaking existing behavior.