feat(dm001): add GitHub archive detection as opt-in maintenance risk signal

[sonukapoor]

Overview

Add GitHub archive/activity detection as an opt-in fourth signal to the DM001 maintenance risk detector (see #732 for the initial implementation).

What it adds

When --check-maintenance --check-network is passed, DM001 checks the GitHub repository linked in the package's npm packument for:

• Archived status (repo is read-only/archived)
• No commits in 2+ years

These are stronger signals of abandonment than staleness alone - an archived repo means the maintainer has explicitly declared the project dead.

Why opt-in

GitHub API calls require rate limit handling and optionally a token. This is heavier than npm registry packument fetches. Keeping it behind --check-network (already used by OA007) avoids surprise latency and auth requirements in the default path.

Data source

GitHub REST API - GET /repos/{owner}/{repo} returns archived boolean and pushed_at timestamp. Repo URL parsed from the repository field in the npm packument.

Implementation notes

• Reuse the existing --check-network opt-in pattern from OA007
• Add githubArchived?: boolean signal to MaintenanceFinding
• Gracefully skip if no GitHub URL in packument, or if API call fails
• To be done in-house

Related

• Part of the dependency hygiene engine: feat: dependency hygiene engine - stale floors, phantom dependencies, and maintenance risk #733
• Extends DM001 initial implementation: feat: maintenance risk scoring for abandonware and downstream dependency drag (DM001) #732
• Follows staleness signal: feat(dm001): add release staleness as third maintenance risk signal #835

[sonukapoor]

To be implemented in-house.