#3415 Docs: dependency trust reports unaudited dependencies (follows #3350)

#3350 changes how swamp extension push and swamp extension quality report a dependency whose OSV or npm lookup failed. Update the manual once #3350 ships.

What changes

• A dependency whose OSV or npm registry lookup fails is reported as not audited: passed false, cause not-audited, and a reason naming the failed source and the HTTP status or network error. It is never reported as passed. A failed weekly-downloads lookup alone does not count.
• In --json the warning stays in warnings.dependencyTrust with cause not-audited; the per-dependency entry in quality's dependencyTrust.audited carries cause and reason. dependencyTrust.passed still means no blockers.
• Unaudited dependencies join the push warnings gate: an interactive push prompts, --yes or --force waives them, and the accepted-warnings record lists them under acceptedWarnings.dependencyTrust. A log-mode push without a terminal and without --yes fails at the prompt while OSV or npm is down. The other dependency trust warnings stay advisory and outside the gate.
• The CLI rubric's dependency-trust factor scores 0 when any dependency was not audited.

Pages to update (content/manual)

• reference/extensions/scorecard-rubric.md: row 10 and the dependency-trust section (an unaudited dependency loses the factor).
• reference/extensions/publishing.md: the --yes gate and accepted-warnings record, the quality output example, the not-audited cause.
• explanation/extension-trust.md: the dependency trust paragraph should say a failed lookup is reported, not treated as clean.
• how-to/extensions/improve-score.md (pass-the-dependency-trust-audit): re-run when OSV and npm are reachable.