#4035 Scorecard: code past the analyzer's read caps, or unreadable, is skipped silently instead of counting as not audited

Repo: swamp-club. Found by the verify-reviews code and adversarial reviews on #3973.

Problem

scanCode in lib/infrastructure/extension-tarball-analyzer.ts stops reading imports once MAX_SOURCE_FILES (500) or MAX_SOURCE_BYTES (50 MiB) is reached, and skips a file whose read returns null. Those files' npm: and jsr: imports are never audited and nothing on the scorecard says so. Since #3973 a module that does not parse is listed as not audited (its imports are unknown), so the same unknown is now handled two ways: a module past the cap fails open where an unparseable one fails closed. An archive could put a dependency past the cap to keep it out of the audit.

Proposal

Report skipped code files as not audited: either each path, or one entry for the read limit. The package's UNREADABLE_MODULE_REASON says the module does not parse, so a cap entry needs its own reason, which may mean a package change in @swamp-club/extension-scoring so the CLI agrees.

Acceptance

• An archive whose code exceeds the read caps does not earn dependency-trust, and the scorecard names why.
• A code file that cannot be read is not audited.
• The CLI's quality score agrees with the registry for the same archive.