## What / Why

`npm audit` can report that a fix is available through `npm audit fix`
when the highest safe version inside the declared dependency range is
older than the installed version.

Arborist already selects that safe candidate using the advisory range,
but `CanPlaceDep` rejects it because replacement candidates normally
must be newer than the installed version. This causes `npm audit fix` to
complete without applying the advertised remediation.

## How

- Pass the existing audit report from `PlaceDep` into `CanPlaceDep` and
recursive peer placement checks.
- Permit an older candidate only when:
  - the installed node is vulnerable;
  - the candidate is not vulnerable; and
- the candidate passes the existing replacement and peer dependency
checks.
- Preserve existing no-downgrade behavior for ordinary installs and
updates.
- Add synthetic, strictly mocked regressions covering:
  - compatible safe downgrades;
  - non-audit placement;
  - still-vulnerable candidates;
  - peer conflicts;
  - actual tree replacement; and
- metavulnerability removal by pruning a vulnerable transitive
dependency.

This does not change audit reporting or `--force` behavior. Fixes
outside declared dependency ranges still require `npm audit fix
--force`.

## Testing

- Focused Arborist placement and audit tests
- npm command-level audit tests

## References

Fixes #9557
Fixes #9718

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
(cherry picked from commit 882d0b2)