#4039 Registry: detect code from outside npm and JSR in a v2 archive itself, not only from the author's dependency-audit.json

Repo: swamp-club (may need swamp for bundle-side detection). Follow-up to #3973, from its adversarial review; Seth agreed to leave it out of #3973.

Problem

Since #3973 the registry charges both dependency-trust points for each entry in a v2 dependency-audit.json's unaudited list (URL imports, git and local package.json dependencies). That list is written by push but shipped in the archive, so an author can delete an entry by hand and the registry never charges for the code.

Proposal

• URL imports: the registry already parses every code module (writtenSpecifiers); also collect URL import specifiers from the source and treat any not listed in unaudited as not audited.
• git and local package.json code lives only in the bundles. Use the per-bundle SHA-256s the v2 record carries (and #3972's bundle checks) so a bundle that does not match the published source is not trusted, or scan bundles for inlined modules outside npm and JSR.

Acceptance

• A v2 archive with a URL import and an unaudited list that omits it loses both dependency-trust points, naming the import.
• The CLI's quality score agrees for the same archive.