#3439 Extension push: a range dependency is sent to OSV as the range, not a version

Problem

The CLI's dependency trust audit (src/domain/extensions/extension_dependency_trust_checker.ts, queryOsvVulns) sends the specifier's version to OSV.dev verbatim. For a range such as npm:express@^4.18.0 or npm:zod@4, OSV is asked about "^4.18.0" or "4", which is not a version.

The registry's scorer (swamp-club#3351) now resolves the specifier first:

• an exact version is used as-is;
• a range resolves to the highest published version that satisfies it (from the npm packument's versions);
• a dist-tag resolves through dist-tags;
• no version resolves to dist-tags.latest.

So push and the scorecard can disagree for any range dependency.

Change

Resolve the version the same way before querying OSV (lib/domain/scorecard/dependency-trust.ts resolveAuditVersion in swamp-club is the reference, using @std/semver maxSatisfying). When nothing satisfies the range, report the dependency as not audited with 'OSV not queried (no published version matches )', which is the registry's wording.

Acceptance

• Unit tests for an exact version, caret and tilde ranges, a bare major, a dist-tag, no version, and a range nothing satisfies.
• The OSV request body carries the resolved exact version.