chore(deps): treat line comments as trivia too in the import scan

From Copilot's fifth pass of #1962. `TRIVIA` covered block comments but not
`//`, despite the contract right above it saying a comment is legal wherever
whitespace is — so `import(// lazy\n"pkg")`, `require(// lazy\n"pkg")`, and
`from // reason\n"pkg"` were stepped over, and such a package would never
enter the candidate set. Same silent-miss direction as the block-comment gap.

Both comment syntaxes are now covered. The line-comment branch runs to
end-of-line only; the newline itself is matched by TRIVIA's `\s` branch.
Regression test added alongside the block-comment one.

The derived set is unchanged at 18 real names — widening trivia does not
admit prose, since a specifier must still follow immediately and
`packageNameOf` rejects anything not shaped like one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HDdo1rNRVQnVRRdsqSrvG3

scripts/verify-dep-lockstep.test.mjs

@@ -118,6 +118,25 @@ test("importedPackageNames: comment trivia between tokens (Copilot, #1962)", ()
   ]);
 });
 
+test("importedPackageNames: line-comment trivia, not just block (Copilot, #1962)", () => {
+  // `//` runs to end-of-line and is legal in every position a block comment is,
+  // so these are valid imports too. The newline is matched by TRIVIA's `\\s`
+  // branch rather than by the line-comment branch.
+  const source = [
+    "import { a } from // reason",
+    '  "express";',
+    "const b = await import(// lazy",
+    '  "undici");',
+    "const c = require(// lazy",
+    '  "yaml");',
+  ].join("\n");
+  assert.deepEqual([...importedPackageNames(source)].sort(), [
+    "express",
+    "undici",
+    "yaml",
+  ]);
+});
+
 test("importedPackageNames: the three specifier forms that introduce types", () => {
   const source = `
     import { z } from "zod/v4";