Dependency health

Flags deprecated packages and releases (npm, Go), yanked releases (PyPI, Cargo, RubyGems), dependencies whose source repository is archived (OpenSSF Scorecard), and direct dependencies with no release in settings["code.dependency-health"].staleYears years (default 3, 0 turns it off). Pinned versions from the lockfiles code.dependencies reads are looked up on deps.dev (Google's Open Source Insights) with one batch request per 100 dependencies and per 100 repositories, plus a package history only where it changes a finding, capped at settings["code.dependency-health"].maxRequests (default 200). Opt-in, because it sends every pinned package name and version to another third party and relies on deps.dev's v3alpha batch API, which has no stability guarantee. Packagist is not covered.