fix: support PEP 508 extras-qualified pins in dependency lock verification - #1007

Resolves #500.

Summary

Updates the _PIN regex in scripts/verify_dependency_lock.py to capture bracketed extras ((?P<extras>\[[^\]]+\])?) alongside package names. parse_lock is updated to gracefully extract these extras, apply PEP 508 canonicalization equivalent to packaging.requirements.Requirement (normalize_name_with_extras), and append them to the base name.

This correctly parses configurations like pydantic[email]==2.13.5 \ as a unique and valid identity instead of rejecting it, while maintaining existing functionality for plain pins and direct URLs.

Type

• Check or risk-model change
• Input adapter change
• CLI or GitHub Action behavior
• Report, schema, or SARIF output
• Documentation only

Authorship

• A coding agent wrote some or all of this change. Agent: Antigravity
• A person read the whole diff before opening this pull request.

Verification

CI is authoritative for python -m ruff check ., python -m compileall -q src tests, and python -m pytest.

Additional local checks run:

• Focused tests passed (4 passed, 0 failed) checking combinations of valid pins, single/multi-extra, direct URLs, and duplicate detection.
• ruff check passed locally with no issues.
• The full pytest tests/test_release_pipeline.py suite reported 189 passed and 7 failed. The 7 failures are known environment incompatibilities executing the allowlist.sh bash script on Windows, wholly unrelated to Python lock parsing.

Release-readiness notes

• No user-code import added to default scan paths
• No network access added to default scan paths
• New or changed check IDs are documented in docs/checks.md
• Report/schema changes are additive or documented in STABILITY.md