fix(update): pattern-match allow-list specifiers and reuse locked metadata

Three related parity gaps surfaced by the `update-allow-list-patterns`
fixture:

1. `mozart-semver`'s wildcard parser turned `*.*` into `>=0 <1` (a
   single-major range) because stripping the trailing `.*` left `*`
   in the major slot, which `parse()` quietly read as `0`. Composer
   reduces such patterns to a plain `*` (unconstrained) — match
   that and short-circuit when the stripped base is `*`.

2. `expand_wildcards` passed any non-wildcard specifier straight
   through, so a typo like `notexact/Test` (lock has
   `notexact/testpackage`) entered the resolver as a real package
   name and failed lookup. Mirror Composer's regex-based
   `isUpdateAllowed`/`warnAboutNonMatchingUpdateAllowList`: every
   specifier — wildcard or not — is matched against locked names
   *and* current root-require names, with `*` expanded to `.*`,
   and unmatched specs are warned and dropped instead of forwarded.

3. The lockfile generator's metadata loop hit the empty test repo
   set when a partial update kept a non-allow-listed package at its
   locked version that the inline repo no longer advertised, and
   bailed with "Could not find version". Add a `previous_lock`
   fallback that synthesizes a `PackagistVersion` straight off the
   `LockedPackage` so the lock entry's own metadata stays
   authoritative for packages that aren't moving.

1 files changed, 6 insertions, 1 deletions

diff --git a/crates/mozart-semver/src/lib.rs b/crates/mozart-semver/src/lib.rs
index 5f6b5fe..0ceaf5a 100644
--- a/crates/mozart-semver/src/lib.rs
+++ b/crates/mozart-semver/src/lib.rs
@@ -846,7 +846,12 @@ fn parse_wildcard(s: &str) -> Result<VersionConstraint, String> {
 
     // Strip trailing .*
     let base = s.trim_end_matches(".*");
-    if base.is_empty() {
+    // `*.*` (and `*.*.*` etc.) collapse to plain `*` after stripping every
+    // trailing `.*` segment — the major slot is itself a wildcard, so the
+    // whole constraint is unconstrained. Composer's `parseConstraint`
+    // reaches the same conclusion via its `xRange` step (any `x` anchor in
+    // a position after a `*` is dropped).
+    if base.is_empty() || base == "*" {
         return Ok(VersionConstraint::Single(Constraint::Any));
     }