[V02] npm fixtures

[yunseo-kim]

Scope

Complete npm package, PURL, workspace, manager, build metadata, OIDC, adapter, publish, permissions, and convergence fixtures.

Contracts

Full npm specs

Dependencies

L04

Blocking issues: [L04] #42.

Executable QA

`go run ./cmd/slsa-builder-internal fixture-check --index testdata/fixtures/index.json --surface npm` must exit 0. `go test ./internal/npmprofile -run '^TestNPMFixtureCorpus$' -count=1 -v` must exit 0, and every rejected fixture must match its expected primary and secondary IDs.