fix(parsers): align cargo compare-output verification

[mstykow]

Summary

• fix Cargo compare-output regressions by keeping real workspace-root packages, surfacing local workspace packages from Cargo.lock, and honoring legacy dev_dependencies / build_dependencies sections
• preserve collective contributor author names such as Tokio Contributors <team@tokio.rs> during common-profile author detection
• record rust-lang/cargo and tokio-rs/tokio benchmark runs in docs/BENCHMARKS.md and mark scorecard row 5 as verified

Issues

• Covers: Cargo/Rust item 5 verification work in docs/implementation-plans/package-detection/PARSER_VERIFICATION_SCORECARD.md
• Closes: none

Scope and exclusions

• Included: repo-backed compare-outputs verification for tokio-rs/tokio and rust-lang/cargo, targeted parser/assembly fixes, focused regression tests, and benchmark/scorecard documentation updates
• Explicit exclusions: no new compiled-binary compare target was run here because the cargo-auditable artifact lane is already tracked separately in verified row 5a

Intentional differences from Python

• Remaining lower dependency counts on a small set of Cargo fixture lockfiles are reviewed non-regressions: ScanCode treats source-less workspace/root lockfile packages as dependency edges, while Provenant preserves the lockfile package inventory without relying on those self-package edges as real external dependencies.

Follow-up work

• Created or intentionally deferred: no additional follow-up beyond the compare artifacts captured under .provenant/compare-runs/; no new golden fixtures were needed for this change set

Expected-output fixture changes

• Files changed: none
• Why the new expected output is correct: the behavior change is covered by focused parser and assembly regression tests plus the saved compare-outputs artifacts, so no parser .expected.json or golden YAML fixture refresh was required