npm.updateDependency/updateArtifacts produces inconsistent SHA pinning for corepack

[rainecheck]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

Other (please specify)

Which version of Renovate are you using?

43.271.3

Please tell us more about your question or problem

We've been experiencing inconsistency in how renovate deals with a package.json packageManager field - sometimes commits would have a sha, sometimes not. I think the cause is that it's being done by two different calls, updateDependency and updateArtifacts, and the latter can be skipped when it isn't desirable to:

branch does not exist
  -> reuseExistingBranch=false
     -> getUpdatedPackageFiles()
        -> npm.updateDependency()
           -> WITHOUT SHA: intermediate packageManager version changes
        -> npm.updateArtifacts()
           -> handlePackageManagerUpdates()
              -> corepack use <manager>@<newVersion>
                 -> WITH SHA: new hashed packageManager value is written

The main problem is that when the branch is preexiting, the updateArtifacts call doesn't get processed as renovate thinks there's no updates to be done. This is technically true, but updateDependency is still processing a change (removing the sha).

related items: #36904, #37772

Logs (if relevant)

DEBUG: Using reuseExistingBranch: true (repository=<snip>
DEBUG: Setting current branch to master (repository=<snip>
DEBUG: latest commit (repository=<snip>
       "branchName": "master",
       "latestCommitDate": "2026-07-20T10:22:49.000Z",
       "sha": "3d7944a0778faaffd6307566bb18036eff0a8bd9"
DEBUG: manager.getUpdatedPackageFiles() reuseExistingBranch=true (repository=<snip>
DEBUG: npm.updateDependency(): packageManager.pnpm = 11.15.0 (repository=<snip>
DEBUG: No package files need updating (repository=<snip>
DEBUG: Getting updated lock files (repository=<snip>
DEBUG: Writing package.json files (repository=<snip>
       "packageFiles": ["package.json", "pnpm-workspace.yaml"]
DEBUG: Writing any updated package files (repository=<snip>
DEBUG: Found 0 npm host rule(s) (repository=<snip>
DEBUG: Found 0 host rule(s) without host type (repository=<snip>
DEBUG: Found 0 host rule(s) without host type after dropping duplicates (repository=<snip>
DEBUG: No updated lock files in branch (repository=<snip>
DEBUG: No changes to package files, skipping post-upgrade tasks (repository=<snip>