fix(references): reject quoted version numbers as file references

[goodhee]

Summary

• reject quoted/code-span reference candidates whose extension is purely
  numeric (e.g. "1.2", "v1.2", "1.2.0-beta.1")
• add a regression test covering quoted version metadata

Before this change, metadata.version: "1.2" in SKILL.md frontmatter matched
the quoted-path pattern (name="1", ext="2") and was treated as a missing
local file reference, flipping an otherwise clean scan from
SAFE/is_complete: true to CAUTION/is_complete: false.

Fixes #524.

Testing

• uv run pytest tests/nodes/test_security_remediation.py -q (310 passed)
• uv run ruff check src/ tests/
• uv run ruff format --check src/ tests/

[rng1995]

[SkillSpector Review]

Reviewed head 1f2739f1fbe004fa10a3a8a809609f25473a646c — REQUEST_CHANGES.

• src/skillspector/references.py:137: the numeric-suffix heuristic rejects real paths, including paths with an explicit directory signal such as docs/tool.1. Numeric extensions are valid (manual pages and numbered artifacts are common), and this rejection happens before the resolver can check known_paths, so a shipped, explicitly referenced file becomes invisible to reference coverage. Apply the version heuristic only to genuinely ambiguous metadata tokens, or first preserve candidates that resolve to a known bundled path. Add a regression for a known docs/tool.1 reference.

Required checks pass, but the correctness regression and mergeStateStatus=BEHIND block merging.

[goodhee]

Thanks for the catch — fixed.

_normalize_candidate now only applies the numeric-suffix ("version number") heuristic to a bare token with no directory component. A candidate carrying an explicit directory signal (e.g. docs/tool.1) is no longer rejected before the known_paths resolver gets to see it, so it can still resolve normally.

Added test_numeric_suffix_path_with_directory_signal_still_resolves covering the docs/tool.1 case you flagged, and confirmed the existing test_quoted_version_number_is_not_a_reference (bare "1.2", "v1.2", "1.2.0-beta.1") still passes.

Branch has been rebased onto latest main.