fix(hex): verify compare-output targets

[mstykow]

Summary

• verify scorecard row 34 (Hex / Elixir) against phoenixframework/phoenix, elixir-ecto/ecto, and elixir-plug/plug with compare-outputs --profile common
• fix shared package license provenance so multi-datafile packages keep manifest-owned license metadata instead of inheriting companion lockfile detections, and tighten author/holder refinement for URL-tail and machine-text false positives
• record the validated runs in docs/BENCHMARKS.md, regenerate the benchmark chart, and mark the Hex / Elixir scorecard row verified

Issues

• Covers: docs/implementation-plans/package-detection/PARSER_VERIFICATION_SCORECARD.md row 34 (Hex / Elixir)

Scope and exclusions

• Included:
  • compare artifacts:
    • .provenant/compare-runs/20260422T142006Z-phoenix-13265
    • .provenant/compare-runs/20260422T142653Z-plug-22829
    • .provenant/compare-runs/20260422T142908Z-ecto-26520
  • focused validation:
    • cargo test from_json_keeps_multi_datafile_package_license_provenance_on_manifest_package
    • cargo test test_refine_holder_strips_trailing_dash_after_url_removal
    • cargo test test_refine_author_drops_html_and_machine_colon_fragments
    • cargo test --features golden-tests test_golden_holders
    • cargo test --features golden-tests test_golden_authors
    • cargo test --features golden-tests test_golden_hex_mix_lock_basic
    • cargo run --manifest-path xtask/Cargo.toml --bin generate-benchmark-chart -- --check
• Explicit exclusions:
  • no mix.exs parsing expansion beyond the existing static mix.lock scope
  • no expected-output or golden fixture updates were required

Intentional differences from Python

• keep Unicode-preserving normalization such as Loïc and José, and treat structured package-party output as more correct than flattened text-only author strings when the underlying metadata supports it