#3973 Registry audits v2 extension archives as written, and a range costs the loose point only without a valid lock

Repo: swamp-club. Step 3 of the extension dependency-forms design, the registry half of #3970. Depends on #3970 being published and on #3781 (the shared rubric package). Design: the extension dependency-forms Doc, https://claude.ai/artifact/WpRbpqb5djPgDXzydFSohs (decided 2026-10-26).

Problem

The registry resolves what an archive ships through a chain: exact, then the record entry, then deno.lock, then a live registry lookup for ranges. Once push ships exact specifiers and a v2 dependency-audit.json (#3970), that chain is redundant for new archives and is a place the CLI and the registry can disagree.

Proposal

• For a recordVersion: 2 archive, resolveShippedVersion takes only the exact branch. Every npm:/jsr: specifier must be exact and match a record entry. A range, a missing entry or a version mismatch is a not-audited finding whose message says the archive breaks the canonical form. No deno.lock read and no live range resolution for these archives.
• Each unaudited record entry (vendored URL, git or non-registry code) is not-audited and costs the dependency-trust point. Seth confirmed this applies from launch, with no notice: the corpus has one such import, an example.com fixture.
• Lock rule, in v1 and v2 archives: a non-exact spec costs the loose point only when no valid lock resolved it. A rescore gives the point back to v1 archives whose ranges were locked, and none loses one.
• The v1 path is otherwise frozen. Its vectors stay, copied from swamp.
• Written in the shared rubric package from #3781, not in swamp-club's own scorer.

Acceptance

• A v2 archive scores with no loose finding and no live lookup.
• A hand-edited v2 archive with a range is not-audited.
• An archive with a URL import loses the dependency-trust point and names the import.
• A locked range keeps both points and a lockless one loses the loose point, in v1 and v2 archives. A v1 archive otherwise scores as before.
• UAT: extend club/flows/dependency_audit_scorecard (U2 in the Doc).