#3662 extension push: record each dependency's audited (locked) version in the archive, so the registry audits what ships (swamp half; registry half #3778)

Split per repo 2026-10-22 (Seth). This issue is now the swamp half. The registry half is swamp-club#3778.

Problem

Take a range or unpinned npm: or jsr: specifier in an extension's source, such as npm:ms@^2. Push audits it at the version the author's deno.lock resolves. That is the version the shipped bundle contains and pull installs. The registry's scorecard scan never sees that lock: push doesn't ship deno.lock, and the analyzer strips one if present. So it resolves the range against the registry's newest match, and can audit a different version from the one consumers install. This applies both to specifiers written out in source and to the bare imports that #3637 and #3612 rewrite to their resolved specifiers.

Expected (swamp)

• Push records, in the archive, the version it audited for each dependency: the locked or resolved version that the bundle ships. That covers specifiers written in source, bare imports resolved through the Deno config (#3612), and package.json-mode imports (#3630).
• The record is additive. Older registries ignore it, and the registry half (#3778) reads it.
• The CLI's own audit and score don't change. They already use the locked version.

Depends on

#3630, which changes the same extractor code; start after it merges.

Acceptance

• Unit tests, using the shared vectors (dependency_audit_vectors.json, kept in step with swamp-club).
• A UAT item covering the archive record, shared with or followed by the UAT for #3778.
• Docs are collected for the single dependency-trust docs update, not done here.

Found while planning swamp-club#3637.