test(npm): resolver/middleware integration tests + CI (S11 Step 6, 4/4)

What

Part 4 of 4 splitting !425 (closed) (S11 Step 6). Integration coverage + CI wiring.

• middleware_integration_test.go (//go:build integration): drives the resolver and middleware against the real FindBySlug query and repositories resolution — happy path, unknown slug, missing repo, wrong format (container), wrong kind (virtual), soft-deleted, cross-namespace isolation, and the HTTP 404 status mapping.
• CI: internal/format/npm/... added to the test:integration package set and to rules:changes.

Review fixes folded into this part: the soft-delete seed binds a time.Time (not the string "now()"), each resolver subtest uses its own t.Context(), and next.resolved is reset per subtest.

Stack

Targets dm/npm-step6-middleware (part 3). Merge order: transport → resolver → middleware → integration.

Spec / plan

• Spec: S11 npm-local — API Contracts, Error Cases (AC 32 / AC 33)
• Plan: 2026-05-11 npm-local, Step 6