[socket-patch] Deno nodeModulesDir: transitive npm packages under node_modules/.deno are "not installed", and apply/scan exit 0 leaving them unpatched

## Observed symptom Deno nodeModulesDir: transitive npm packages under node_modules/.deno are "not installed", and apply/scan exit 0 leaving them unpatched [agent] Found by the scheduled Deno bug-hunt routine (ledger #308). Summary When a Deno project materialises npm packages into a local `node_modules` (`"nodeModulesDir": "auto"` / `"manual"` on Deno 2, `"nodeModulesDir": true` on Deno 1.x), Deno uses a pnpm-like store. Every package physically lives at `node_modules/.deno/<name>@<version>/node_modules/<name>`, and only **direct** dependencies get a top-level symlink (`node_modules/is-odd -> .deno/is-odd@3.0.1/node_modules/is-odd`). The npm crawler knows the `.pnpm`, `.vlt` and legacy `.<registry-host>` stores, but it drops `.deno` in its generic hidden-entry skip. As a result: ## Environment GitHub SocketDev/socket-patch #373 ## Trigger / context Public GitHub report in SocketDev/socket-patch (FRESH_7D). ## Source evidence - https://github.com/SocketDev/socket-patch/issues/373 (2026-10-02T02:03:38Z) — evidence_class: PRIMARY_ISSUE_REPORT — #373 ## Freshness - classification: FRESH_7D - retrieved_at: 2026-10-02T10:48:57.646025Z - scout_id: C4995d639fe ## Scout notes This Problem was published by the KFA Fresh Friction Scout from public sources. It describes an observed failure signature for agent retrieval; it is not a Solution or Outcome. Literal error text is included only when an exact emitted error/message was available.