chore(deps): route packageurl-js external shim through -stable + catalog

Two cleanups to align socket-lib's @socketregistry/packageurl-js
external shim with the fleet-wide stable-only catalog policy:

  1. src/external/@socketregistry/packageurl-js.js: shim now does
     `require('@socketregistry/packageurl-js-stable')` instead of the
     canonical name. The stable alias resolves to the same npm
     package version; the rename makes the dep graph match the rest
     of the fleet (every other socket-lib import goes through
     -stable).

  2. package.json: replace the direct version pin
     `"@socketregistry/packageurl-js": "1.4.2"` with the catalog
     reference `"@socketregistry/packageurl-js-stable": "catalog:"`.
     Same one-line consistency improvement applied to
     `@socketsecurity/lib-stable` and `@socketsecurity/sdk-stable`
     entries that were also direct `npm:<pkg>@<ver>` specs — all
     three now resolve through `catalog:` to the same workspace-level
     pin in pnpm-workspace.yaml. Centralizes version control in the
     catalog block; one edit there bumps all consumers.

Verified: `pnpm install` succeeds, the shim's require resolves
correctly (`PackageURL: function`), and the operations.test.mts
suite passes (77/77, 26 skipped — pre-existing). edit.test.mts has 5
unrelated pre-existing failures from the earlier `pkgJsonToEditable`
removal (commit f3b87a3); not in scope for this change.

Author: jdalton

package.json

@@ -2295,11 +2295,10 @@
     "@npmcli/promise-spawn": "8.0.3",
     "@sinclair/typebox": "0.34.49",
     "@socketregistry/is-unicode-supported": "1.0.5",
-    "@socketregistry/packageurl-js": "1.4.2",
-    "@socketregistry/packageurl-js-stable": "npm:@socketregistry/packageurl-js@1.4.2",
+    "@socketregistry/packageurl-js-stable": "catalog:",
     "@socketregistry/yocto-spinner": "1.0.25",
-    "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@5.28.0",
-    "@socketsecurity/sdk-stable": "npm:@socketsecurity/sdk@4.0.1",
+    "@socketsecurity/lib-stable": "catalog:",
+    "@socketsecurity/sdk-stable": "catalog:",
     "@types/node": "24.9.2",
     "@typescript/native-preview": "7.0.0-dev.20260415.1",
     "@vitest/coverage-v8": "4.0.3",

pnpm-lock.yaml

@@ -1,3 +1,3 @@
 'use strict'
 
-module.exports = require('@socketregistry/packageurl-js')
+module.exports = require('@socketregistry/packageurl-js-stable')