Fix the dependency screen for AI-suggested packages

You asked an AI for an HTML sanitizer, and it told you to pip install htmlsanitizer-pro. Models invent plausible package names, and attackers register those names to catch the installs. Your team now screens every AI-suggested dependency against the package index before anyone installs it.

An assistant wrote screen_dependency_suggestions(records, registry_names). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• records: one per suggested package, written name|monthly_downloads|has_repo. has_repo is 1 when a public source repository is linked and 0 when not.
• registry_names: the names that really exist on the package index.
• Return one verdict per record, in order: "malformed", "hallucinated", "unvetted" or "approved".

Rules the tests check. Use the first that applies:

1. "malformed": the record does not split on | into exactly 3 fields, or the name is empty, or the downloads field is not one or more digits from 0 to 9, or has_repo is not exactly 0 or 1.
2. "hallucinated": the name is not on the registry. Compare names the way the package index does, on both sides: lowercase the ASCII letters and treat _ as -. Nothing else changes: no trimming, and other characters stay as they are.
3. "unvetted": fewer than 1000 monthly downloads, or has_repo is 0.
4. "approved" otherwise.