perf(npm-registry,scanner): include publishedAt in fix version resolutions to avoid redundant resolveVersionPublishDate call

[luojiyin1987]

Closes #741

Problem

In validateDirectFixTargets, both resolvePublishedFixVersion and resolveVersionPublishDate fetch the same packument for the same package. resolvePublishedFixVersion already has the packument in scope — it could also read packument.time[version] and return the publish date, avoiding the second resolveVersionPublishDate call (packument cache lookup + time access + cache write).

Changes

• Extended PublishedFixVersionResolution with publishedAt: string | null
• resolvePublishedFixVersion: added publishedAt to all return paths
• resolveLowestKnownNonVulnerableVersion: added publishedAt to success return paths
• Removed attachFixVersionPublishDate helper; replaced with inline setPublishedDate helper
• Removed now-unused resolveVersionPublishDate import from scanner.ts

Verification

• TypeScript: no errors
• Tests: 110/110 pass (lowest-safe-version, osv-cache, all detector tests)

[sonukapoor]

Two things to address before merging:

1. The !packument early return in resolvePublishedFixVersion (before the first hunk in this file) omits publishedAt. Since the type marks it optional with ?, TypeScript will not flag this - but setPublishedDate in scanner.ts checks if (date === undefined) return and skips setting finding.fixVersionPublishedAt to null. The old attachFixVersionPublishDate explicitly set fixVersionPublishedAt = null when validation failed; this new path loses that guarantee. Adding publishedAt: null to the !packument return restores it.

2. resolveVersionPublishDate in npm-registry.ts is now a dead export - the import was removed from scanner.ts but the function definition still exists. Worth deleting to keep the module surface clean.

[sonukapoor]

Merged — thank you @luojiyin1987!