fix(cli): create empty yarn.lock for yarn projects in migration

Yarn Berry's hardened mode on public PRs forbids lockfile creation but
allows updating an existing one. The YARN_ENABLE_HARDENED_MODE env var
cannot override this auto-detection. Instead, create an empty yarn.lock
during migration so yarn install treats it as an update.

Author: fengmk2

.github/workflows/test-vp-create.yml

@@ -144,8 +144,6 @@ jobs:
       # Force full dependency rewriting so the library template's existing
       # vite-plus dep gets overridden with the local tgz
       VP_FORCE_MIGRATE: '1'
-      # Yarn Berry enables hardened mode on public PRs, blocking lockfile creation
-      YARN_ENABLE_HARDENED_MODE: false
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 

packages/cli/src/migration/migrator.ts

@@ -1126,6 +1126,14 @@ function rewriteYarnrcYml(projectPath: string): void {
     // catalog
     rewriteCatalog(doc);
   });
+
+  // Ensure yarn.lock exists so yarn install can update it in CI.
+  // Yarn Berry's hardened mode on public PRs forbids lockfile *creation*
+  // but allows *updating* an existing one.
+  const yarnLockPath = path.join(projectPath, 'yarn.lock');
+  if (!fs.existsSync(yarnLockPath)) {
+    fs.writeFileSync(yarnLockPath, '');
+  }
 }
 
 /**