refactor: delegate dependency checks to git-pkgs modules

[andrew]

This moves yul's manifest parsing, exact-version checks, latest-version selection, enrichment routing, and GitHub ref resolution onto APIs contributed to the git-pkgs modules. The local behavior now comes from released modules instead of parallel implementations.

Removing the duplicate code exposed several bugs in yul:

• Source declarations were keyed by package or action name, so the same dependency in multiple package.json sections and repeated uses of a GitHub Action could overwrite one another.
• Changed-pin detection compared only the version at a location, so replacing a package or action with a different one at the same version could be missed.
• Version comments for SHA-pinned actions were keyed only by action name. Repeated pins of the same action at different SHAs could therefore use the wrong version comment.
• Any pin different from the registry's reported latest version was treated as outdated, including a pin that was newer than the reported latest version.
• npm aliases were not consistently resolved to the aliased package identity.
• yul always constructed the ecosyste.ms enrichment backend directly, bypassing the configured direct or hybrid backend.

These changes depend on work contributed upstream:

• git-pkgs/vers#32, released in v0.4.0, adds shared exact-version detection for native constraints.
• git-pkgs/manifests#74, released in v0.10.0, adds location-aware declarations for npm, PyPI, and GitHub Actions while preserving duplicate declarations.
• git-pkgs/registries#69, released in v0.8.0, centralizes latest-version selection.
• git-pkgs/forge#150, released in v0.9.0, adds GitHub ref-to-commit resolution.
• git-pkgs/enrichment#60, released in v0.7.0, delegates latest-version selection to registries.

The yul integration keeps its existing timeout and User-Agent behavior while delegating those shared responsibilities.