fix(assembly): preserve pnpm workspace lockfile dependencies

[mstykow]

Summary

• Preserve sibling lockfile dependency hoisting when npm/pnpm workspace members are reassembled.
• Preserve shared workspace-root lockfile dependencies even without a root package manifest, and stop removing workspace roots by shared PURL alone.
• Normalize npm workspace lockfile path keys such as packages/foo back to linked package names instead of emitting path-derived npm PURLs.
• Add a pnpm/pnpm benchmark checkpoint from .provenant/compare-runs/20260427T175225Z-pnpm-87511 and refresh the benchmark chart.

Issues

• Covers:
• Closes:

Scope and exclusions

• Included:
  • src/assembly/npm_workspace_merge.rs
  • src/parsers/npm_lock.rs
  • src/parsers/npm_lock_test.rs
  • src/parsers/npm_scan_test.rs
  • docs/BENCHMARKS.md
  • docs/benchmarks/scan-duration-vs-files.svg
• Explicit exclusions:
  • No scorecard row changes.
  • No golden expected file updates.

Intentional differences from Python

• Keep URL-safe encoding for path-shaped lockfile metadata while preferring real linked package names over raw workspace path keys in npm lockfile-derived dependency identities.

Follow-up work

• Created or intentionally deferred:
  • None.

Expected-output fixture changes

• Files changed: none.
• Why the new expected output is correct: focused npm and pnpm workspace regression tests plus the targeted test_assembly_npm_workspace, test_assembly_pnpm_workspace, and pnpm_lock goldens all passed without requiring fixture refreshes.