fix(package): include namespace in shallow score purl output

[John-David Dalton (jdalton)]

What

socket package shallow dropped the package namespace from the purl it printed in the report card. A scoped npm package like @axe-core/react was rendered as:

Package: pkg:npm/react@4.11.0

instead of pkg:npm/@axe-core/react@4.11.0. The informational log line (Requesting shallow score data for ... pkg:npm/@axe-core/react) already showed the correct purl, so the mismatch was confusing.

Fixes #971.

Root cause

formatReportCard() in output-purls-shallow-score.mts rebuilt the purl from ecosystem / name / version but skipped the namespace segment:

const purl = `pkg:${artifact.ecosystem}/${artifact.name}${artifact.version ? `@${artifact.version}` : ''}`

preProcess() already tracks namespace on the deduped artifact (and the deep-score renderer includes it), so only the report-card purl was affected.

Change

• src/commands/package/output-purls-shallow-score.mts — add the namespace segment to the report-card purl, matching how preProcess() and the deep-score renderer build purls.

-const purl = `pkg:${artifact.ecosystem}/${artifact.name}${artifact.version ? `@${artifact.version}` : ''}`
+const purl = `pkg:${artifact.ecosystem}/${artifact.namespace ? `${artifact.namespace}/` : ''}${artifact.name}${artifact.version ? `@${artifact.version}` : ''}`

Testing

• Added a focused regression test (namespaced packages (issue #971)) asserting the scoped-npm purl and the no-namespace case, calling formatReportCard directly.
• Updated the Go shallow snapshots, which now correctly show the module namespace (pkg:golang/github.com/steelpoor/tlsproxy@...) — this is the same bug for Go modules.
• vitest run test/unit/commands/package/ — 146 passed.
• pnpm run lint <files> — passed.

Before / after (Go shallow report, showing the same bug for module namespaces)

Before: Package: pkg:golang/tlsproxy@v0.0.0-...
After: Package: pkg:golang/github.com/steelpoor/tlsproxy@v0.0.0-...

---

Note

Low Risk
CLI display-only purl formatting fix with targeted unit tests; no API or scoring logic changes.

Overview
Fixes #971 by including the namespace segment when formatReportCard builds the purl for shallow package score text and markdown output, aligned with preProcess() and the deep-score renderer.

Scoped npm packages (e.g. @axe-core/react) and other namespaced ecosystems (Go modules, Maven coordinates) now show canonical purls such as pkg:npm/@axe-core/react@… instead of dropping the namespace and showing only the bare name.

Adds direct formatReportCard regression tests for scoped vs non-scoped npm and updates Go/Maven fixture snapshots to expect the corrected purls.

^{Reviewed by Cursor Bugbot for commit 402cea1. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 402cea1. Configure here.}

[John-David Dalton (jdalton)]

CI note (both red checks are pre-existing, not from this PR):

• 🔎 Check — fails on unrelated oxlint findings in scripts/repo/stage-publish-cli-exe.mts ("unnecessary assertion"). Already red on origin/main (the Check job on the latest main commit fails identically); this PR does not touch that file.
• 🧪 Test — fails only on test/integration/cli/cmd-ci.test.mts > socket ci (a branch-name-dependent banner snapshot). It fails on every non-main PR regardless of contents.