Resolve pinned audit snapshot path that crosses unrelated package versions

Refs #66, #720.

The pinned original audit snapshot requires a dependency edge that does not exist in its own lockfile. Both files are byte-identical to Bun pin 4982b91e3702094330f3be3883354c52b8c01323.

Snapshot path: express -> connect -> csurf -> csrf -> uid-safe -> base64-url

The lockfile resolves csrf's uid-safe dependency to csrf/uid-safe@2.1.4. That package depends on random-bytes; it has no base64-url dependency. The snapshot joins edges from different versions under the same package name.

Home's resolved-version report instead finds the real path: express -> connect -> express-session -> uid-safe@2.0.0 -> base64-url@1.2.1.

The standalone validator verify-audit-snapshot-edges.py reads the unchanged fixture and snapshot, checks their bytes against the pinned Git objects, resolves each dependency edge, and proves the expected path invalid and Home's path valid. Results are retained in audit-snapshot-edges.json. Fixture SHA-256: a3a708d385a1556a96a04643279ec6f72786c2d64bd2c0b039e0ce2fb6de9e8c; snapshot SHA-256: db90c80cdbeb3c55b9a79e5636c2d350597f523c8e5988f559f481882d47c4a7.

The original audit test remains a reported failure, not a fabricated pass. Do not restore the false name-merged edge, skip the assertion, rewrite output in the gate, or silently rewrite the pinned snapshot to make this green. Track resolution of the upstream fixture/expectation inconsistency and maintain the stronger native production/version/workspace path regressions. Full logical-suite completion remains unproven while this discrepancy is unresolved.

The edge proof is now committed in ecf4cad18: evidence manifest, with the validator, its complete output, and structured edge records. It verifies both input files against pinned Git objects before reading the graph.

At runtime 13fda557c, build 46/46, all seven native regressions pass, and the original audit remains 15/16. Native production/version/workspace path assertions pass. The original failing expected base64-url path resolves csrf/uid-safe@2.1.4, whose declared dependencies contain no base64-url edge. Home's alternative resolves uid-safe@2.0.0 -> base64-url@1.2.1 and every edge exists.

The upcoming 952744932 build preserves the upstream representative-path traversal order for valid paths while retaining resolved IDs, semver filtering and cycle protection. 8c8c57740 adds a real installed dependency cycle regression. It cannot legitimately recreate the snapshot's absent edge. No original test/snapshot has been edited or counted as passing. Refs #66, #720.

Verified and pushed runtime 952744932, cycle regression 8c8c57740, and final evidence 3ff5c660a, as Chris Breuer without coauthors. Build 46/46. All seven native private regression files pass; original link/binlink 11/11 per runtime. The audit fixture exercises real installed cycles, version-specific production reachability, workspace paths, advisory ranges, actual gzip POST/authentication, filters/errors and unchanged locks.

Original audit: Home 15/16; pinned Bun 16/16, each with 16 JUnit cases and unchanged original sources/snapshots. The snapshot now differs by exactly one line: its expected csrf/uid-safe@2.1.4 -> base64-url edge does not exist in the pinned fixture. Home's express-session -> uid-safe@2.0.0 -> base64-url@1.2.1 path is valid. All other representative paths match. This remains a recorded original failure, with no snapshot rewrite or fabricated dependency edge. #720/#721 remain open; full parity remains incomplete under #66.

Baseline · 38 final build/test artifacts · pinned edge proof. Generated fixture data was archived/inventoried and removed.