#3778 Registry dependency audit: audit the locked version push records in the archive, not the registry's newest match for a range specifier (swamp-club half of #3662)

Summary

This is the swamp-club half of #3662, split per repo on 2026-10-22 (Seth). The registry's dependency audit should check the dependency version that the shipped bundle actually contains, using the version push records in the archive. Today it uses the registry's newest version that matches a range specifier.

Problem

Take a range or unpinned npm: or jsr: specifier in an extension's source, such as npm:ms@^2. Push audits it at the version the author's deno.lock resolves. That is the version the shipped bundle contains and the version pull installs.

The registry's scorecard scan never sees that lock: push doesn't ship deno.lock, and the analyzer strips one if present. So lib/domain/scorecard/dependency-trust.ts resolves the range against the registry's newest matching version. The registry can therefore audit, and score, a different version from the one consumers install. The same applies to the bare imports that #3637 and #3612 rewrite to their resolved specifiers.

Depends on

The swamp half, #3662: push records each audited dependency's locked version in the archive.

Expected

• When the archive records a locked version for a dependency, the registry audits that version. OSV, deprecation, JSR yank and license checks all use it.
• The loose-specifier finding still applies to the specifier as written, because the range is still loose. Only the audited version changes, which matches the CLI's rule from #3354 and #3682.
• An archive from an older swamp that records no versions keeps today's behaviour: resolve the range and audit the newest match.
• Update the shared vectors in tests/fixtures/dependency_audit_vectors.json and swamp's copy together, so the CLI and the registry stay in agreement.

Acceptance

• Unit tests, using the shared vectors.
• A UAT item: push an extension whose lock pins an older version of a range dependency. The scorecard should show findings for the locked version, not the newest.
• Docs are collected for the single dependency-trust docs update (#3725, #3728 and the rest), not done here.