feat: vendor/scan/apply overhaul — lockfile-driven discovery, verified auto-fetch, mismatch-tolerant apply #331

Job	Run time
test (macos-latest)	7m 12s
lint-ecosystems	6s
test (windows-latest)	17m 5s
clippy	28s
test (ubuntu-latest)	8m 44s
test-release	18m 6s
coverage-docker (pypi)	5m 26s
coverage	4m 48s
coverage-docker (cargo)	6m 6s
coverage-docker (maven)	4m 32s
setup-matrix (gem)	3m 9s
setup-matrix (golang)	3m 0s
coverage-docker (golang)	4m 52s
coverage-docker (gem)	5m 16s
setup-matrix (cargo)	3m 9s
setup-matrix (pypi)	4m 38s
setup-matrix (nuget)	3m 12s
e2e-docker (pypi)	4m 26s
e2e-docker (cargo)	4m 19s
coverage-docker (composer)	5m 15s
coverage-docker (deno)	5m 16s
setup-matrix (composer)	3m 9s
setup-matrix (maven)	5m 12s
e2e-docker (npm)	4m 16s
e2e-docker (golang)	4m 10s
e2e-docker (maven)	4m 24s
e2e-docker (nuget)	4m 14s
e2e-docker (composer)	4m 20s
coverage-docker (nuget)	5m 11s
e2e-docker (gem)	4m 9s
dispatch-tests	11s
setup-matrix (npm)	4m 5s
coverage-docker (npm)	5m 17s
setup-matrix (deno)	3m 9s
e2e-docker (deno)	4m 23s
coverage-merge	36s
e2e (ubuntu-latest, e2e_safety_cargo_build)	32s
e2e (ubuntu-latest, e2e_cargo)	35s
e2e (ubuntu-latest, e2e_golang)	38s
e2e (ubuntu-latest, e2e_composer)	34s
e2e (ubuntu-latest, e2e_safety_pnpm)	41s
e2e (ubuntu-latest, e2e_maven)	36s
e2e (windows-latest, e2e_safety_cargo_build)	3m 33s
e2e (ubuntu-latest, e2e_nuget)	34s
e2e (macos-latest, e2e_safety_pnpm)	55s
e2e (macos-latest, e2e_safety_cargo_build)	48s
e2e (windows-latest, e2e_safety_pnpm)	4m 13s
	3h 9m 30s

Provide feedback