Land combined dependency snapshots before main-based verification #2505

Goal

Land the bounded dependency-review code repair in PR #2492 so a real dependency update can be checked against a new main snapshot.

Code acceptance

• Use matching full-tree component detection on main and same-repository dependency PR heads, plus one combined manual npm/uv snapshot per side.
• Include every distinct tracked npm lock version and the scoped root uv.lock graph; reject incomplete, extra, wrong-version, wrong-manifest, wrong-scope, or warning-bearing compare evidence.
• Keep the current vulnerability/license policy, exact SHA binding, bounded warning retry, Python fallback limitation, and focused regression tests.
• Merge PR fix: match dependency snapshots on update pull requests #2492 only at its separately approved exact head after required checks and review threads are clear.

Parent outcome

Parent issue #2490 remains open after this code lands. Its acceptance requires a new main snapshot and a refreshed original manifest-changing PR with a warning-free hosted policy verdict and complete artifact. The off-main #2501 canary passed all 12 exact lock changes but does not prove that final main-based result.