#3870 package.json mode: no loose-specifier warning for a range push ships as the exact installed version

In package.json mode (swamp-club#3630), push ships each bare import as npm:@, an exact pin, and audits that installed version. But quality and push still raise loose-specifier against the range package.json declares, for example: npm:ms@^2.1.0 is a range; audited 2.1.2, the version this push resolves (installed in node_modules). The fix line asks the author to pin the exact installed version in package.json.

Nothing is loose about what ships: the archive carries the exact version and dependency-audit.json records it with from installed. The registry scorecard sees the exact pin and raises no loose-specifier finding, so local quality scores one point lower than the registry for the same archive, which breaks the rubric promise that push and the registry give the same findings.

Proposal (from Seth): when a range resolves to an exact version that push writes into the shipped source, do not warn. Keep loose-specifier for a range that ships as written. Local quality and the registry should then agree for package.json-mode extensions.

Found while documenting dependency trust for swamp-club#3725; until this ships the manual will describe the current local-vs-registry difference.