#4053 extension push: file:, link:, workspace: and git package.json dependencies are left out of the unaudited list when the project also has a deno.json

Found while triaging swamp-club#3974 (manual: supported dependency categories).

Problem

Push lists code from outside npm and JSR under the v2 dependency-audit.json unaudited list so the registry charges the dependency-trust factor for it (swamp-club#3970, #4018). For package.json non-registry dependencies (file:, link:, workspace:, portal:, path and git specs) that only happens in a package.json-only project: src/infrastructure/runtime/deno_info_module_graph_reader.ts:563-567 collects them only in package-json mode. In a project with a deno.json beside the package.json (deno.json wins the project mode), an import-map name resolving into node_modules from such a dependency is inlined into the bundle with no record entry and no unaudited entry, so it scores as if it were free. Read from code; no dependency_input_vectors fixture covers it (package-json-file-dependency is package.json-only).

Expected

The same non-registry dependency lands under unaudited, with its origin and module hashes, whichever project mode push is in.

Acceptance

• A dependency_input_vectors fixture: deno.json plus package.json, a file: dependency reached through the import map, expected under unaudited with kind package-json.
• A git spec under the same layout lands as kind git.

Related: swamp-club#4039 (the registry detecting such code from the archive itself) would also catch it at score time.