feat: vendor/scan/apply overhaul — lockfile-driven discovery, verified auto-fetch, mismatch-tolerant apply #324

Job	Run time
coverage	6m 9s
test (macos-latest)	8m 23s
test (windows-latest)	21m 58s
test-release	18m 54s
test (ubuntu-latest)	7m 49s
coverage-docker (pypi)	5m 24s
coverage-docker (composer)	4m 27s
e2e-docker (maven)	4m 19s
dispatch-tests	9s
coverage-docker (deno)	4m 35s
coverage-docker (cargo)	5m 13s
coverage-docker (nuget)	5m 19s
e2e-docker (gem)	4m 52s
e2e-docker (pypi)	4m 5s
e2e-docker (deno)	4m 12s
setup-matrix (cargo)	3m 6s
setup-matrix (nuget)	3m 16s
e2e-docker (composer)	4m 11s
coverage-docker (maven)	5m 27s
e2e-docker (cargo)	4m 14s
setup-matrix (composer)	2m 42s
setup-matrix (npm)	3m 43s
e2e-docker (nuget)	4m 14s
setup-matrix (gem)	3m 1s
setup-matrix (deno)	3m 9s
setup-matrix (pypi)	4m 25s
coverage-docker (npm)	5m 17s
setup-matrix (maven)	3m 58s
lint-ecosystems	7s
e2e-docker (golang)	3m 54s
setup-matrix (golang)	2m 41s
e2e-docker (npm)	4m 17s
coverage-docker (gem)	5m 19s
clippy	48s
coverage-docker (golang)	4m 55s
coverage-merge	0s
e2e (ubuntu-latest, e2e_maven)	1m 36s
e2e (ubuntu-latest, e2e_safety_cargo_build)	1m 31s
e2e (ubuntu-latest, e2e_nuget)	1m 31s
e2e (macos-latest, e2e_safety_cargo_build)	2m 8s
e2e (ubuntu-latest, e2e_golang)	1m 31s
e2e (ubuntu-latest, e2e_cargo)	1m 31s
e2e (ubuntu-latest, e2e_composer)	1m 31s
e2e (windows-latest, e2e_safety_pnpm)	3m 57s
e2e (windows-latest, e2e_safety_cargo_build)	3m 37s
e2e (macos-latest, e2e_safety_pnpm)	2m 23s
e2e (ubuntu-latest, e2e_safety_pnpm)	1m 43s
	3h 21m 31s

Provide feedback