Each JS lockfile extractor now implements ArtifactExtractor.GetArtifact()
to emit ScannedArtifact for the adjacent package.json with workspace
ProjectDeps, enabling build file tree resolution for Node.js monorepos.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

Extract shared getArtifactFromAdjacentPackageJSON helper to satisfy
dupl linter while keeping independent GetArtifact per extractor. Add
end-to-end integration test verifying GenerateSBOM -> GetBuildFileTrees
pipeline for npm workspace monorepos, including flag gating.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

- Add workspaceGlobs custom UnmarshalJSON to handle both array-form
  ("workspaces": [...]) and object-form ("workspaces": {"packages": [...]})
  in package.json, fixing silent decode failure for Yarn nohoist repos
- Rewrite PnpmLockExtractor.GetArtifact to read workspace packages from
  pnpm-lock.yaml importers map instead of package.json workspaces field,
  covering repos that declare workspaces only via pnpm-workspace.yaml
- Add test for pnpm-workspace.yaml-only workspace discovery
- Apply prettier formatting to npm-workspace test fixtures

…ctDeps

Read the `name` field from each workspace child's package.json so that
ArtifactDetail.Name is set for every ProjectDep, giving GetBuildFileTrees
a meaningful artifact ID for each workspace package instead of an empty string.

…ents

Set Ecosystem on ProjectDeps entries so cyclonedx.go can generate a purl
for stub components. Previously workspace children (e.g. packages/x-cli)
appeared in the SBOM as unnamed file nodes; now they carry their npm package
name (e.g. pkg:npm/%40quramy%2Fx-cli) via the datadog:maven-package property.

…ild file trees

When a workspace child (e.g. packages/x-cli) declares a dependency on a
sibling workspace package (e.g. @quramy/x-core), the edge was missing from
the build file tree because only one ScannedArtifact is produced per lockfile.

AddNpmWorkspaceEdges post-processes the BOM in GenerateSBOM (where the scan
root is known) by reading each package.json file component, cross-referencing
its dependencies against the workspace name→path index built from the BOM's
file components, and injecting any missing edges into bom.Dependencies.

Normal scanning and SBOM generation are unaffected — the enrichment only runs
when ExtractArtifactIds is enabled and the result feeds into GetBuildFileTrees.