#3629 registry scorecard reports dependency trust passed for versions with bare imports it cannot audit

The registry scorer's dependency trust analysis (lib/infrastructure/extension-tarball-analyzer.ts, scanForDependencies) extracts npm: and jsr: specifiers from source text only. Push does not ship deno.json, and the analyzer strips any it finds, so a bare import mapped through the extension's import map is never seen. Such a dependency is bundled into the published extension, yet the scorecard records dependencyTrustPassed true with no OSV, deprecation, license or JSR check for it.

Going forward, swamp-club#3637 makes push rewrite bare imports in the shipped source to their mapped npm:/jsr: specifiers, so new versions are audited by the existing scan with no registry change, and swamp-club#3611 audits them at push time. That leaves versions already published (and versions pushed by older CLIs), whose archives carry no import map, so the registry cannot resolve their bare imports.

Expected: when the source scan finds bare import specifiers, the scorecard reports dependency trust as incomplete (not audited) rather than passed, naming the bare imports it could not resolve. Re-scoring existing versions applies it to the corpus.

Scale: the swamp-extensions corpus carries 1,352 import-map entries across 703 deno.json files (from the swamp-club#3352 census).