fix: apply the run credential to the npm ping probe

What does this MR do and why?

npm.meta.ping built its GET /-/ping request with a raw http.NewRequestWithContext and sent it through ne.HTTPClient(). That path never reaches client.Client.newRequest, which is where applyCredential runs, so the probe sent no credential at all. Against any registry that authenticates /-/ping, the row could therefore only ever report 401, whatever the route actually does — pointing triage at the credential instead of at the route.

The raw request also omitted the standard User-Agent: registry-conformance/... header that S06 §Request shape requires on every request.

This builds the ping request through the npm client so it carries the run credential and the standard request shape, while still reading the response body directly (the body assertion cannot use the body-discarding Client.Ping).

Closes #87 (closed).

How

• pkg/client/npm/client.go: added an exported Client.NewRequest that wraps the existing unexported newRequest. It applies the credential and the S06 request shape (User-Agent, Content-Type rules); it does not send the request, so a caller that must read the response body itself can still obtain a correctly-shaped, credentialed request.
• pkg/conformance/npm/meta.go: testMetaPing now builds its request via ne.Client().NewRequest(...) instead of a raw http.NewRequestWithContext. The request is still sent through ne.HTTPClient() so the probe keeps the run's request timeout and cross-host-redirect SSRF policy, and the body is still read directly for the {} assertion.

Test coverage

• pkg/conformance/npm/meta_test.go: the test registry now records the ping request's Authorization and User-Agent headers, and a new test, TestMetaPing_appliesCredential, asserts a bearer run credential reaches the registry as Authorization: Bearer <token> and that the standard User-Agent is present. The test fails before the change (empty Authorization) and passes after it.
• go build ./..., go vet, and gofmt are clean; the full pkg/conformance/npm package passes.