feat: add pnpm and yarn lockfile provider support

[thomasjiangcy]

Summary

• add provider support for pnpm-lock.yaml and yarn.lock
• teach project auto-discovery and shorthand inference about the new npm lockfiles
• add fixture coverage and CLI integration tests for git-backed pulls from those lockfiles

Testing

• cargo clippy --all-targets --all-features -- -D warnings
• cargo test