Add lockfile integrity evidence gates

[tick25108-cpu]

Fixes #384.

This updates the dependency-scanning skill so lockfiles are treated as artifact provenance evidence, not only as resolved dependency lists.

What changed:

• Adds lockfile source, integrity/checksum, git immutability, install-script, signature/provenance, and manifest-lockfile alignment gates.
• Clarifies that npm resolved, integrity, and hasInstallScript fields are normal evidence fields and should not be findings by themselves.
• Extends the output template with artifact integrity findings and supply-chain indicators for missing integrity, unexpected artifact sources, signature gaps, and metadata drift.
• Adds lifecycle-script safety guidance so package install hooks are reviewed as evidence, not executed.
• Adds npm package-lock and audit-signature references.

Validation:

• git diff --check
• confirmed Markdown fence balance
• confirmed markers for Lockfile Artifact Integrity, Artifact Integrity Findings, npm audit signatures, hasInstallScript, and lifecycle-script safety guidance are present

Submitting this as an Improver contribution. Payment details can be handled privately after maintainer acceptance.