fix(llm-security): v8 Phase 1 — Berry lockfile, nested-v1 recursion, per-occurrence strip attribution

Three TDD-first fixes surviving the B8 roadmap bucket (v8.0.0-plan.local.md
Phase 1, items 1-3; item 4 JAR hardening scoped out at review):

- supply-chain-recheck.mjs parseYarnLock: ported the hook's per-entry parser
  (pre-install-supply-chain.mjs) so Berry's `version: x` format (unquoted) is
  recognized alongside Classic's `version "x"` — Berry lockfiles previously
  yielded zero deps, silently missing pinned compromised packages.
- supply-chain-recheck.mjs parsePackageLock: lockfileVersion-1 fallback now
  recurses nested `dependencies`, mirroring the hook's walk() — a transitive,
  non-hoisted compromised copy below the top level was previously invisible.
- content-extractor.mjs stripInjection: attribution moved from a global
  `Set<label>` to `Set<label::lineIndex>`. The old check silenced the
  unstripped flag for ANY occurrence of a label once ANY occurrence had been
  line-redacted, so a second, cross-line-only encoded occurrence of the same
  label survived into sanitized output without being flagged.

Full suite 2019/2019 (one known-flaky timing test confirmed green in isolation).

tests/scanners/content-extractor-strip.test.mjs

@@ -74,4 +74,37 @@ describe('content-extractor — stripInjection removes what it reports', () => {
     assert.match(sanitized, /keep-after/);
     assert.ok(!sanitized.includes(encoded));
   });
+
+  it('flags a second, cross-line occurrence of an already-stripped label as unstripped', () => {
+    // Two occurrences of the SAME label: the first is single-line encoded
+    // (caught + redacted by the per-line pass), the second is split across
+    // two lines so no individual line's decoded form matches — only the
+    // whole-text normalization does (the documented residual gap). A global
+    // `attributed.has(label)` check wrongly treats the second occurrence as
+    // handled because the FIRST one was; it must be judged on its own line
+    // span instead.
+    const singleLine = htmlEntities('ignore all previous');
+    const crossLineA = htmlEntities('ignore all');
+    const crossLineB = htmlEntities('previous');
+    const text = [
+      'keep-before',
+      singleLine,
+      'keep-middle',
+      crossLineA,
+      crossLineB,
+      'keep-after',
+      '',
+    ].join('\n');
+    const { sanitized, findings } = stripInjection(text, 'README.md');
+
+    assert.ok(!sanitized.includes(singleLine), 'the single-line occurrence must be stripped');
+    assert.ok(
+      sanitized.includes(crossLineA) && sanitized.includes(crossLineB),
+      'the cross-line occurrence is expected to survive stripping (documented residual gap)'
+    );
+    assert.ok(
+      findings.some(f => f.unstripped === true),
+      'a payload that survives into sanitized output must be flagged unstripped, not silently reported as handled'
+    );
+  });
 });