Fix obfuscation false positives and coordinate-bound audit caching

[tonibergholm]

Summary

• require dynamic execution evidence before classifying encoded/minified content as obfuscation
• preserve high findings for JavaScript eval, decoded Function source, and computed require targets
• bind cached audit reports to name, version, and actual tarball integrity so explain cannot return another coordinate report
• refresh vulnerable dependencies to patched versions and document both semantic changes in ADR-0054 and ADR-0055

Why

The registered calibration still produced false blocks for legitimate WASM/runtime packages after ADR-0053. The rule conflated encoding and runtime glue with concealed code execution. Separately, AuditStore documented a coordinate-bound key but implemented integrity-only lookup, allowing byte-identical package coordinates to share metadata-dependent findings.

Impact

Cold probes now allow @emnapi/core@1.9.2 at 84 and @tailwindcss/oxide-wasm32-wasi@4.1.16 at 80 with no obfuscation findings. The committed synthetic malicious package remains blocked at score 0. Explain responses remain bound to the requested coordinate. npm audit reports zero vulnerabilities.

Validation

• npm run build
• full hermetic Node test suite
• npm audit --json (0 vulnerabilities)
• cold direct audits of the two named WASM/runtime packages

The complete four-tree consuming-repository calibration still needs a cold rerun because those lockfiles are not present in this repository.