feat(pm): add outdated command

[elrrrrrrr]

Summary

• add ut outdated [patterns...] with the ut out alias
• report lockfile Current, range-compatible Wanted, registry Latest, location, and dependent
• support direct dependencies across root/workspace selection, npm aliases, catalogs, workspace protocols, and overrides
• reuse cache-clean package pattern matching, registry manifest caching, and lockfile edge lookup
• add deterministic local-registry E2E coverage for normal, scoped, alias, override, filtering, and exit-code cases

Behavior

• exits with status 1 when outdated or missing production dependencies are found
• exits with status 0 and no output when the result is empty
• keeps workspace and non-registry dependencies local/skipped instead of querying the registry
• applies matching Utoo overrides before calculating Wanted

Validation

• cargo test -p utoo-pm (331 passed, 3 ignored)
• cargo clippy --all-targets -- -D warnings --no-deps
• cargo fmt --check
• focused local-registry outdated E2E
• Biome and typos checks for changed files
• git diff --check

Closes #3228

[gemini-code-assist]

Code Review

This pull request introduces a new outdated command to check for outdated direct dependencies by comparing local versions from the lockfile with those available on the registry. The feedback focuses on improving the resilience of the command by gracefully handling missing .utoo.toml files, failed manifest fetches, and version resolution errors instead of failing the entire command. Additionally, a logic issue was identified where packages already at the latest version might be incorrectly reported as outdated.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

If the current version of a package is already equal to the latest version available on the registry, it is fully up-to-date and should be skipped. The current check only skips when current == wanted == latest, which incorrectly reports packages as outdated if they are at the latest version but have a different wanted version (e.g., due to an override or manual lockfile modification).

Suggested change

	if dependency.current.as_deref() == Some(wanted.as_str()) && wanted == latest {
	continue;
	}
	if dependency.current.as_deref() == Some(latest.as_str()) {
	continue;
	}