feat(dm001): add release staleness as third maintenance risk signal

[sonukapoor]

Overview

Add release staleness as a third signal to the DM001 maintenance risk detector (see #732 for the initial implementation).

What it adds

When --check-maintenance is passed, DM001 currently fires on CVE-blocking drag and npm deprecated packages. Staleness adds a third signal: the time since the package's last published version on the npm registry.

A package with no release in 2+ years is a maintenance risk even before it starts dragging a transitive dep below a safe version. Surfacing this early gives teams a signal to plan replacement before a CVE forces the issue.

Proposed output

MEDIUM   lodash@4.17.21   maintenance risk (DM001)
         Last release: 2021 (3 years ago)

Signal weight

Medium - staleness alone is not a build-breaking signal. It raises to high when combined with CVE-blocking drag.

Data source

npm registry packument - time field keyed by version. Already fetched for drag-candidate packages; staleness check is a free addition for those. For deprecated-only or staleness-only candidates, a packument fetch is required.

Implementation notes

• Add staleness?: { lastPublished: string; ageYears: number } to DragSignal or as a sibling field on MaintenanceFinding
• Threshold: configurable, default 2 years
• To be done in-house

Related

• Part of the dependency hygiene engine: feat: dependency hygiene engine - stale floors, phantom dependencies, and maintenance risk #733
• Extends DM001 initial implementation: feat: maintenance risk scoring for abandonware and downstream dependency drag (DM001) #732

[sonukapoor]

To be implemented in-house.