feat(lockfiles): parse npm, pnpm, yarn, bun, Go and Cargo lockfiles - #2041

🟢 Confidence 10/10 · safe to merge. Held at 8 because the earlier review found defects: the only code read here is the five files changed since, and both fixes hold with tests.
_{no findings · tests covered · risk low}

Adds @maple/lockfiles, a lib/ package that turns npm, pnpm, yarn, bun, Go and Cargo lockfiles into a flat locked-package list with relations, plus ecosystem-aware version ordering. It is a pure parser library with no caller yet; the delta since the 8a97f93 review (pnpm multi-document reads, crates.io-only Cargo sources) is correct and pinned by tests, so it is safe to merge.

• parseYamlDocuments reads every document of a pnpm YAML stream, not only the first
• parsePnpmLock joins importers and packages across all pnpm documents
• parseCargoLock keeps only crates.io crates, from the git or sparse index
• parsePnpmLock skips alternate-registry and non-registry packages with a warning count

Production impact

_{1739974 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}