fix(update): pattern-match allow-list specifiers and reuse locked metadata

Three related parity gaps surfaced by the `update-allow-list-patterns`
fixture:

1. `mozart-semver`'s wildcard parser turned `*.*` into `>=0 <1` (a
   single-major range) because stripping the trailing `.*` left `*`
   in the major slot, which `parse()` quietly read as `0`. Composer
   reduces such patterns to a plain `*` (unconstrained) — match
   that and short-circuit when the stripped base is `*`.

2. `expand_wildcards` passed any non-wildcard specifier straight
   through, so a typo like `notexact/Test` (lock has
   `notexact/testpackage`) entered the resolver as a real package
   name and failed lookup. Mirror Composer's regex-based
   `isUpdateAllowed`/`warnAboutNonMatchingUpdateAllowList`: every
   specifier — wildcard or not — is matched against locked names
   *and* current root-require names, with `*` expanded to `.*`,
   and unmatched specs are warned and dropped instead of forwarded.

3. The lockfile generator's metadata loop hit the empty test repo
   set when a partial update kept a non-allow-listed package at its
   locked version that the inline repo no longer advertised, and
   bailed with "Could not find version". Add a `previous_lock`
   fallback that synthesizes a `PackagistVersion` straight off the
   `LockedPackage` so the lock entry's own metadata stays
   authoritative for packages that aren't moving.

0 files changed, 0 insertions, 0 deletions