== 1. fresh: npx bb-app@latest (writes the cache entry)
{
  "dependencies": {
    "bb-app": "^0.38.0"
  },
  "_npx": {
    "packages": [
      "bb-app@latest"
    ]
  }
}
  "version": "0.38.0",
== 2. simulate a cache created when latest was 0.35.1 (exactly the reporter's entry)
{
  "dependencies": {
    "bb-app": "^0.35.1"
  },
  "_npx": {
    "packages": [
      "bb-app@latest"
    ]
  }
}
  "version": "0.35.1",
== 3. run npx bb-app@latest again against that entry
npm http fetch GET 200 https://registry.npmjs.org/bb-app 100ms (cache revalidated)
npm http cache https://registry.npmjs.org/bb-app 2ms (cache hit)
{
  "dependencies": {
    "bb-app": "^0.38.0"
  },
  "_npx": {
    "packages": [
      "bb-app@latest"
    ]
  }
}
  "version": "0.38.0",
If step 3 shows 0.38.0 the 'hard pin' claim is refuted for this npm.