pack stuck on flagged for manual review

`vtokic/comfyui-cable-management` (barney-tearspell, `cable-management` pack)
two versions approved by @ltdrdata three weeks ago, bugfixes and features submitted after that stuck on flagged with the identical issue

**ai assisted diagnosis**

suspicion: the scanner's python socket YARA rules are being run against `.js`.
all 8 findings on our 1.2.1 are `python_network_operations` / `any-network-requests`
at confidence 90, and every one resolves to two raw substrings:

| pattern | matched | what it actually is |
|----------|----------|----------------------------|
| $socket3 | `.connect(` | litegraph `node.connect(slot, target, idx)` |
| $socket4 | `.bind(` | `Function.prototype.bind` |

no parsing, no language awareness — one of our findings is reported against a
line that is a comment. any pack touching litegraph's link API trips this, which
would explain why this isn't isolated to one publisher.

the tell: our 1.0.0/1.0.1 carry the **identical** findings in their
`statusHistory` and are only Active because they were hand-approved. nothing
regressed in our code after that — the finding count grew because the pack grew.
so this isn't versions going bad, it's every version being flagged and only some
getting a manual pass.

also worth noting `/security-scan` only pulls *pending* versions, so nothing
re-examines a flagged one. it's terminal without a human, no queue, no expiry.

Start at the `/security-scan` entry point and trace how the scanner applies Python socket YARA rules to JavaScript pack contents and how flagged versions are handled. Reproduce the reported `.connect(` and `.bind(` matches, including the comment match, then verify that legitimate litegraph and Function.prototype usage no longer causes these findings and that flagged versions can be reconsidered.

Written by the indexing model from the issue text.