docs: clarify versioned override parent behavior

[ded-furby]

Summary

• clarify that a versioned parent override key also applies that spec to the matched parent package
• document how to keep the parent package on its existing spec with "." while only overriding children
• add a focused example that addresses the confusion in [DOCS] package.json overrides parent keySpec overrides parent version #9121

Testing

• docs-only change
• attempted local validation, but the fresh clone does not have npm/cli dev dependencies bootstrapped (node ./scripts/resetdeps.js is required before broader checks can run)

[owlstronaut]

Nice clarification, and the core point checks out. I confirmed in the arborist code and with a real install that a versioned key like @npm/bar@2.0.0 really does pin the parent, not just gate the nested overrides. One thing to fix though: the $ reference needs the full scoped name, so ".": "$bar" actually errors with Unable to resolve reference $bar. It should be ".": "$@npm/bar". The same bug exists in the "@npm/foo": "$foo" example just below it, so it might be worth fixing both while you're here.

[owlstronaut]

see above

[ded-furby]

Implemented the scoped override follow-up in docs: added explicit note that / are unscoped and do not match scoped packages, and kept the examples using full scoped refs (, ) in . Please re-review when convenient.

[ded-furby]

Implemented the scoped override follow-up in docs: clarified that and are unscoped references and kept the examples using full scoped references (npm/foo, npm/bar) in package-json docs.

[ded-furby]

Implemented the follow-up request on the override examples. The parent-key example now explicitly uses , and the direct dependency reference examples now show both unscoped-invalid and scoped-correct forms (/ vs /). Please feel free to re-review.

[ded-furby]

Implemented the follow-up request on the $ override examples.
The parent-key example now explicitly uses "." : "$@npm/bar", and the direct dependency reference examples now include explicit bad scoped-unscoped pairs ("$foo" / "$bar" vs "$@npm/foo" / "$@npm/bar").
Please re-review when convenient.