fix(audit): keep coverage unknown for a PE header past the probe

A packaged member whose PE signature lies beyond the probe prefix stayed
unclassified, so the embedded-package probe never ran and coverage stayed
complete. A map inside such an image then read as not_observed.

Record the member as an unexamined package where it is already marked as
a possible native image.

src/artifacts/ReleaseExposureReader.test.ts

@@ -2147,6 +2147,7 @@ describe("ReleaseExposureReader unexpanded packages", () => {
     expect(scanned.omitted).toContainEqual(
       expect.objectContaining({ subject: PACKAGED_NATIVE_IMAGES, count: 1 }),
     );
+    expect(scanned.coverage).toBe("unknown");
   });
 });
 

src/artifacts/ReleaseExposureReader.ts

@@ -1557,9 +1557,11 @@ const examinePackagedBinary = async (
       windows.state === "signature-needed" ||
       (windows.state === "candidate" && windows.signature === "unobserved")
     ) {
-      // The image may be native, so it stays unexamined by the on-disk readers.
+      // The image may be native, so it stays unexamined by the on-disk readers,
+      // and it may carry a package that nothing here can clear.
       state.packagedNative += 1;
       notePeNotExamined(state, member.location);
+      noteUnexaminedPackage(state);
     }
   }
   if (native === null && header !== null && holdsAsarHeader(header)) {