Lockfile trust chain

Use it on every dependency PR or lockfile regeneration and again before a release cut. It rejects blank package names, versions, explicit node IDs, root resolved IDs, dependency references, and any supplied non-string or blank source coordinate before analysis. Four parallel probes then find mutable registry/path/URL/Git sources—including case-insensitive git+, git://, ssh://, and SCP-style Git coordinates unless pinned to a full commit—missing, weak, malformed, or truncated integrity evidence using algorithm-specific decoded digest lengths, roots whose transitive closure is absent or padded with unreachable entries using iterative traversal with bounded cycle witnesses, and version/source conflicts against manifest intent including npm-compatible caret-zero bounds; a synthesis join reports whether the lock can anchor a repeatable install and orders repairs by severity. It reads JSON only and performs no install, fetch, write, or registry c