fix: preserve fields the public batch consumer needs through the policy reshape

[John-David Dalton (jdalton)]

What

reshapeArtifactForPublicPolicy (in src/http-client.mts) rebuilds each artifact from a fixed key allowlist when the caller uses a public API token. That allowlist dropped several fields the public batch consumer (the web extension popover) actually needs. This PR widens the allowlist to preserve those fields. It does not change alert reshaping or the public policy.

Why

When a public token is in use (SOCKET_PUBLIC_API_TOKEN === SOCKET_PUBLIC_API_KEY), batchPackageFetch/batchPackageStream run every artifact through reshapeArtifactForPublicPolicy, which rebuilt each artifact as { name, version, size, author, type, supplyChainRisk, scorecards, topLevelAncestors, alerts }. A field audit of socket-webext (background.ts batch handling + content/ rendering) found these fields are read but were being stripped:

• inputPurl — the request→response correlation key background.ts uses to map each batch reply back to the purl it asked for. Not sensitive (the caller supplied it). Error rows already kept it (they have no alerts field, so they fell through the reshape unchanged), so success rows were asymmetric.
• namespace — completes the coordinate for scoped/grouped packages (npm @scope, Maven groupId, Go module path); used in the popover display title and the socket.dev link. Missing → namespaced packages render wrong.
• score — the SocketScore subscore object the popover reduces (Object.values(score) → min) to drive the score bar. Distinct from scorecards (which was already kept). Missing → the bar always shows the default 100%.
• artifactId, classifier, ext, params, path, platform, section — optional deep-link routing qualifiers the shared packageLink() reads to build correct socket.dev URLs for non-npm ecosystems (Maven classifier/ext, PyPI artifactId, RubyGems platform, Go path). Copied only when present. npm unaffected.

All of these are non-sensitive package identity / health / routing data. None is an alert.

Change detail

src/http-client.mts:

• The reshapeArtifact closure (used by both the data.artifacts array path and the single-artifact data.alerts path, so both batch code paths are covered) now also emits inputPurl, namespace, score, and ...pickPresentDeepLinkFields(artifact).
• Added ArtifactDeepLinkQualifiers (all-optional local interface — these 7 fields aren't in the generated OpenAPI SocketArtifact schema) and pickPresentDeepLinkFields(), which copies each qualifier only when defined so the reshaped shape stays minimal. Typed with no casts; SocketArtifactWithExtras stays assignable to the intersection because every qualifier is optional.

test/repo/unit/reshape-artifact-public-policy.test.mts:

• Added an inputPurl correlation key preservation block plus cases asserting namespace + score survive, the 7 qualifier fields survive when present, and are omitted when absent, and that error rows still carry inputPurl (symmetry).

Pure data changes, no node deps — the browser bundle (dist/index.browser.js) still packs, is node-builtin-free, and emits the widened reshape.

Verified green: tsgo --noEmit, lint, reshape + batch unit tests (89 across the staged set), full build.

Explicitly out of scope

Alert reshaping is unchanged. Each alert stays { action, key, severity, type }, and the mandated public policy — dropping severity: 'low' alerts and applying the actions policy filter — stays exactly as-is (this matches the extension's ApiAlert shape, so no alert-level change is needed). This PR only widens the per-artifact field allowlist; it does not touch the alert set or its filtering.