Reconcile GitHub dependency-graph alerts with canonical resolved lockfiles

[anulum]

Problem

GitHub currently exposes stale or over-broad dependency findings that do not match the canonical resolved lockfiles:

• Dependabot attributes JupyterLab and pymdown-extensions alerts to requirements.txt, although that compatibility surface does not declare either package.
• OpenSSF Scorecard associates historical advisories with package declarations while the hosted pip-audit job reports no known Python vulnerabilities in the installed hash-locked environment.
• The one concrete Rust soundness warning found during review (anyhow below 1.0.103) has been updated in spo-kernel/Cargo.lock.

The discrepancy should be fixed at the dependency-graph data source, not hidden by dismissing alerts without evidence.

Proposed work

• identify which static, automatic, Dependabot, or manual submission supplies each stale manifest record
• make submitted snapshots use stable detector and correlator identities
• submit resolved PURLs from the canonical lockfiles with correct runtime or development scope
• verify that current snapshots supersede stale submissions without disabling dependency scanning
• document the reconciliation and preserve exact audit evidence

Acceptance criteria

• hosted pip-audit, cargo audit, and cargo deny pass on the same SHA
• every remaining GitHub alert maps to an actual package and vulnerable resolved version
• stale alerts close through corrected graph data or are dismissed only with owner-approved evidence
• dependency scanning, security updates, and push protection stay enabled
• no dependency version is weakened merely to influence a score

GitHub dependency submissions are additive and use detector/correlator precedence, so changes must be tested carefully before altering repository settings.