test: pin semver build-metadata precedence and exercise the real versionMatchesRange path

[Retsumdk]

Closes #1087

Adds the two test gaps called out in the issue.

1. Semver build-metadata coverage (tests/helpers.test.ts)

Semver §10 says build metadata is ignored for precedence, so 1.2.3+build
and 1.2.3 are equal, and likewise for variants carrying a pre-release
(e.g. 1.2.3-beta+a vs 1.2.3-beta+b). Nothing asserted this before, so a
regression of the (?:\+.*)? group in VERSION_SHAPE could go unnoticed.

I verified the new assertions kill that mutation: deleting (?:\+.*)?$
from VERSION_SHAPE makes the test fail (Expected: 0, Received: 1).

2. Exercise the real versionMatchesRange path (tests/local-advisory-source.test.ts)

The existing #1077 test hand-copies the body of versionMatchesRange
into the test, so it proves compareVersions but not the scanner path it is
named after. This adds an end-to-end test that seeds a lodash advisory fixed
at 4.17.21 and asserts:

• lodash@4.17.21-beta.1 (below the fix) is flagged vulnerable
• lodash@4.17.21 (at the fix) is not flagged

It goes through LocalAdvisorySource.queryBatch → the real
versionMatchesRange in src/advisory/local-db.ts. I verified it catches
the boundary mutation (>= 0 → > 0): that flips the at-fix case to
vulnerable and fails the test.

Verification

• npm test passes for both files (--no-cache); full suite unchanged
  from baseline (no new failures).
• npm run build and test-hygiene lint pass.
• Test-only change; no behavior in src/ modified.

[sonukapoor]

Really strong first contribution, and I want to be clear that the substance is right before I ask for anything.

I verified both gaps by mutation. Deleting (?:\+.*)? from VERSION_SHAPE produces exactly one failure across 1,684 tests, and it is your build-metadata test. Making versionMatchesRange pre-release-blind produces exactly one failure, and it is your scanner test. Each of your two tests is now the sole guard in the repo for the thing it covers. That is exactly what the issue asked for, and the fact that you ran the mutations yourself and put the output in the PR body is not something I see often.

One thing to fix, and I am fairly sure it is a paste that got away from you rather than anything you meant. tests/helpers.test.ts:354:

it("ranks a pre-release below its associated release (semver 11.3)", () => {    expect(compareVersions("1.2.3", "1.2.3")).toBe(0);
  expect(compareVersions("1.2.3-beta", "1.2.3-alpha")).toBeGreaterThan(0);
});

It duplicates the name of the real test ten lines below, its body is a copy of the assertions from the test above it, and the name does not describe what it asserts. Deleting those three lines is the whole fix. We have no linter yet, so nothing in CI catches a duplicated test name.

One optional question. The old test at tests/helpers.test.ts:389 still hand-copies versionMatchesRange into the test body, which is what your new test now does properly. Happy either way, but if you want to rename it to something that describes what it actually tests, or drop it as superseded, that would be a tidy finish.