feat(nodejs): infer build edges from pnpm workspace: protocol dependencies

[bruno-archastro]

This PR enhances the Node.js plugin to correctly infer build dependencies between workspace members when using the pnpm workspace: protocol (as well as yarn-berry/bun). Previously, only file: specifiers and npm workspaces siblings by name were recognized, causing consumers to build before their dependencies and resulting in TypeScript errors (TS2307/TS7016).

Key changes:

• Parse pnpm-workspace.yaml packages: globs alongside the existing npm workspaces field to discover workspace members.
• Recognize all forms of the workspace: protocol and resolve them to workspace members:
  • Path forms (workspace:./pkg, workspace:../pkg) resolve by relative path.
  • Alias forms (workspace:@scope/dep@*) resolve by aliased name.
  • Range forms (workspace:*, workspace:^, workspace:~, workspace:1.2.3, etc.) resolve by the dependency key.
• Apply dependency resolution across both dependencies and devDependencies, deduped by resolved path.
• The resolved member feeds the same <member>:build edge as file: dependencies, ensuring a dependency's build completes before its dependents.
• Adds comprehensive tests for all workspace: forms, pnpm workspace discovery, and end-to-end build edge inference.
• Updates CLI tests to verify that build edges are correctly inferred and exposed in the graph and why commands for pnpm workspaces.

This fixes build ordering issues in pnpm/yarn-berry/bun monorepos and ensures correct dependency resolution for all supported workspace protocols.

[archastro]

✅ Clean PR, @bruno-archastro! No blocking findings on 4638dc1 — a few nice things I clocked:

• Nice consolidation of the dependency loop — file:, workspace: (path/alias/range), and bare-sibling specifiers now resolve through one pass and feed the same <member>:build edge, deduped by resolved path. 🎯
• Clean extension of workspace discovery — workspace_patterns_at prefers package.json workspaces then falls back to a deliberately minimal, dependency-free pnpm-workspace.yaml parser.
• Solid red-green discipline — the end-to-end test locks the exact build-ordering failure mode the fix addresses, including CLI graph/why JSON edge coverage. 🙌

---

_{Reply @archastro <verb>: review · do <pattern> · don't <pattern> · forget <slug> · list}