Review

Clean, well-scoped fix. The wildcard → <= tagged_version change is the right call: the old latest fallback could select a version newer than the tagged one, and capping at the tagged version matches npm-pick-manifest/pnpm. Prerelease semantics and the exact-version strictness are both correctly handled and tested. Approve.

A couple of minor, non-blocking suggestions:

1. unwrap() on the constructed range (libs/npm/resolution/common.rs):

VersionReq::parse_from_npm(&format!("<={tagged_version}")).unwrap()

In practice tagged_version is always a valid Version, so this should never fail — but it couples panic-safety to the assumption that Version's Display always round-trips through parse_from_npm as a <= comparator, including edge cases like build metadata (1.0.0+build). Worth a one-line comment explaining why the unwrap is safe, or building the VersionReq from the parsed Version directly to avoid the string round-trip.

2. Dead DistTagNotFound branch in resolve_best_matching_dist_tag_fallback_version_info: this fn is only reached after tag_to_version_info already returned DistTagVersionTooNew, which guarantees the tag exists in dist_tags. The else is harmless defensive code, but a brief // unreachable in practice; defensive comment would clarify intent.

Test coverage is unit-level only (no spec test reproducing the @typescript/native-preview@latest case from #35552), but since this is pure resolution logic the four deno_npm tests are adequate. The test helper refactor is a nice cleanup.