#4018 Extension scoring audits v2 archives exact-only and charges unaudited code, in the package and the CLI alike

Repo: swamp. The package and CLI half of #3973 (the registry audits v2 archives as written). #3973's swamp-club PR pins the package version this publishes; #3980's rescore waits for that pin. Design: the extension dependency-forms Doc, https://claude.ai/artifact/WpRbpqb5djPgDXzydFSohs (C1).

Problem

@swamp-club/extension-scoring 0.20261027.4 (#3970) writes and reads the v2 dependency-audit.json, but nothing scores with it: a v2 archive still resolves through the lock and a live range lookup, and the unaudited list (URL, git and non-registry package.json code) costs nothing. The CLI's scorer does not count unaudited code either, so once the registry does, swamp extension quality and push would score an extension with a URL import higher than the scorecard.

Proposal

In packages/extension-scoring:

• A v2 path for the dependency audit: with a recordVersion: 2 record, a specifier takes only the exact branch. Every npm:/jsr: specifier must be exact and match a record entry (canonicalShippedSpecifierIssue); a range, a missing entry or a version mismatch is a not-audited finding saying the archive breaks the canonical form. No lock read and no live range resolution; OSV, deprecation and yank lookups still run for the exact version.
• Each unaudited entry is a not-audited finding naming its origin, so it costs both dependency-trust points, with a fix telling the author to replace it with an npm: or jsr: package.
• v1 archives are unchanged: the lock-or-exact rule from #3970 stays, and they never pay for URL imports.
• RUBRIC_VERSION stays 6 (Seth: the versions of the last day collapse into one).
• Vectors: v2 scoring cases (exact-only, range, missing entry, mismatch, unaudited URL) in vectors/dependency_audit.json.

In the CLI:

• swamp extension quality and push count the graph's unaudited code through the same package function, so the CLI and the registry give an extension with a URL, git or file: dependency the same dependency-trust points and findings.
• The swamp skill's rubric reference describes the current rubric only, not per-version history.

Acceptance

• The package vectors pass in the package, in swamp's runner and in the registry (via #3973).
• An extension with a URL import scores 0/2 dependency-trust in swamp extension quality, push and the registry scorecard, naming the import.
• A v2 archive with a hand-edited range or a record mismatch is not-audited.
• A v1 archive scores as under 0.20261027.4.
• The package publishes to JSR on merge.