fix(supply-chain): prefer exact known-package matches in SC6

[agentsope]

SC6 reports the known package uvicorn as a possible typosquat of gunicorn because the similarity loop returns before reaching the exact match. Check normalized exact membership across the popular-package set before approximate matching, preserving the existing similarity thresholds and candidate ordering for unknown packages.

Add regressions through dependency analysis and the helper for overlapping known names, case folding, and underscore/hyphen normalization. Existing PyPI and npm typo-positive tests remain covered.

Addresses the uvicorn/gunicorn observation in #523, not the other findings in that issue.

Validation:

• Before the fix: 5 regression failures, 3 passes in the targeted selection.
• After the fix: all 480 tests in tests/unit/test_patterns_new.py pass.
• make lint and make format-check pass.
• PATH="$PWD/.venv/bin:$PATH" make test-unit: 4,821 passed, 14 skipped, 38 deselected, 4 expected failures.
• .venv/bin/pytest -q -m integration tests/integration --ignore=tests/integration/test_agent_cli_live.py: 17 passed. Optional live-provider tests were not run.

[yashrajp22]

On behalf of NVIDIA, thank you @agentsope for contributing to SkillSpector!

• Fixed SC6 false positives for exact package matches and added regression tests.

We're merging this PR.