fix: clean up check-new-deps hook

[John-David Dalton (jdalton)]

Summary

• Remove dead low-quality-score warning logic (the malware API only checks for malware, not scores)
• Remove incorrect comment about SDK batch routing heuristic
• Rename critical variable to malware for clarity

Test plan

• cd .claude/hooks/check-new-deps && npm test

---

Note

Low Risk
Behavior is narrowed to malware-only blocking with mostly removal/cleanup; limited risk aside from potentially no longer surfacing non-blocking low-score warnings.

Overview
Simplifies the check-new-deps pre-tool hook to only block on malware results from SocketSdk.checkMalware(), removing the previous low-quality-score warning path and related return structure.

Updates messaging/comments/docs to match the new behavior (malware-only blocking), and renames internal variables for clarity when evaluating alerts.

^{Reviewed by Cursor Bugbot for commit 55fab25. Configure here.}