feat(check): honor Yarn project resolutions

[aldegad]

Summary

• resolve npm approval closures from the actual Yarn project lockfile and root resolutions
• scope approval-ledger reuse to the canonical project, resolutions, and lockfile context
• fail closed when the project resolution graph cannot be materialized
• document the closure evidence and approval-isolation contract in English and Korean

Verification

• npm test
• git diff --check
• staged gitleaks secret scan

Regression coverage

• patched Next closure with Sharp 0.35.3 and PostCSS 8.5.21 is approved from the actual project graph
• unsafe or missing-resolution project context remains denied
• approval from one Yarn project cannot authorize another project

[aldegad]

Independent orchestration review.

Reviewed the project-scoped Yarn closure, context-keyed ledger behavior, PreToolUse context enforcement, safe/unsafe regression fixtures, and English/Korean documentation mirrors. npm test passed locally; GitHub CI passed on Ubuntu and macOS; staged secret scan and git diff --check passed.

The implementation preserves fail-closed behavior when a project closure is absent or vulnerable and prevents approval reuse across project contexts.