* feat(cli): support bun.lock text-based lockfile from Bun 1.2

Bun 1.2 changed from a binary lockfile (bun.lockb) to a text-based
lockfile (bun.lock). Change representativeLockfile to
representativeLockfiles (string[]) so package managers can declare
multiple lockfile names. Earlier entries in the list are preferred.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(cli): scope lockfile detection to sandbox root in fixture-sandbox

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>