fix: verify registry manifest identity

[martinrrm]

Summary

• reject signed or attested registry manifests whose name does not match the requested package
• reject manifests whose explicit _id does not match their name@version
• reject manifests whose selected version is listed under a different version key
• preserve normal non-verifying fetch behavior and support aliases, staged versions, and npm-pick-manifest copies

This prevents a compromised registry or mirror from replaying valid metadata from another package and making npm audit signatures treat it as verified for the requested package.

Tests

• npm test with temporary Git identity for fixture commits
• full suite passes with 100% coverage
• ESLint and template-oss checks pass through posttest
• each replay/identity rejection regression fails when its corresponding guard is removed
• passing coverage includes valid signed manifests, aliases, manifests with no verification metadata, and existing non-verifying fetch behavior

Release notes

This is a security fix for verification-enabled pacote consumers. Normal installs without signature or attestation verification are unchanged.