test(enrichment): unit coverage for the provenance analyzer pure classifiers

[JSONbored]

review-enrichment/src/analyzers/provenance.ts (209 lines) has no test. isSafeToCheck, classifyAddedFile, and matchesPypiVersion are pure and gate whether the (networked) attestation lookups run — cover them directly. Part of the REES analyzer runtime.

Deliverables

• Create review-enrichment/test/provenance.test.ts
• isSafeToCheck: safe pkg+version vs versions/names the analyzer refuses to query (both branches)
• classifyAddedFile: npm vs pypi vs unrelated added files
• matchesPypiVersion: exact and normalized version comparison, non-match arm
• Leave hasNpmAttestation/hasPypiProvenance/scanProvenance network calls out of scope

References

• review-enrichment/src/analyzers/provenance.ts:35
• review-enrichment/src/analyzers/provenance.ts:44
• review-enrichment/src/analyzers/provenance.ts:89

Part of #1499.

---

size: S · gittensor:bug

[linear-code]

JSO-2215