fix(release-exposure): count an unexpanded nested package as a readable member

An unencrypted nested package that inventory recognized but did not
expand is still a member its parent package already read. Count it as
readable so packaging.extractable_payload reports exposed, while its
own contents keep coverage unknown.

src/artifacts/ReleaseExposureReader.test.ts

@@ -1352,6 +1352,10 @@ describe("ReleaseExposureReader source spellings", () => {
     expect(scanned.source_maps.embedded).toBe(0);
     expect(scanned.coverage).toBe("unknown");
     expect(sourceMapSourcesStatus(scanned)).toBe("unknown");
+    expect(scanned.extractable.readable_members).toBe(1);
+    expect(scanned.extractable.samples).toEqual([
+      expect.stringContaining("inner.asar"),
+    ]);
   });
 
   it("reopens a decomposed compressed .NET member", async () => {

src/artifacts/ReleaseExposureReader.ts

@@ -482,13 +482,19 @@ const scanOccurrences = async (
       continue;
     }
     // A nested package that inventory recognized but did not expand was
-    // never assessed, so its members leave coverage unknown.
+    // never assessed, so its members leave coverage unknown. The nested
+    // package itself is still an unencrypted member of its parent that
+    // inventory already read, so it counts as a readable payload.
     if (
       packageKind !== null &&
       !parentsWithChildren.has(occurrence.occurrence_id)
     ) {
       state.formats.add(packageKind);
       noteUnexaminedPackage(state);
+      if (!occurrence.encrypted) {
+        state.readable += 1;
+        pushSample(state.memberSamples, location);
+      }
       pushLimitation(state, `Nested package ${location} was not expanded.`);
       continue;
     }