Bind registry audits to version tags

[Ismail-elkorchi]

Summary

• verify npm provenance against the peeled commit of the manifest version tag
• resolve the tag only when npm metadata exists, so unreleased version audits can still report absence
• fetch complete history and tags in the scheduled release audit
• add regression coverage that prohibits binding published provenance to current HEAD

Cause

A published package version is immutable, but main advances after release. Comparing npm provenance with checkout HEAD therefore rejects a correct package after the first post-release merge. The version tag is the stable source identity for that artifact.

Validation

• live npm and JSR registry checks both report identical from post-release main
• decoded npm SLSA provenance resolves to the peeled v0.2.0 commit
• focused registry tooling tests
• npm run check:fast
• ESLint
• actionlint
• diff whitespace validation