Very nice, I can follow with a smaller one to remove some ugliness from spack.bootstrap

@scheibelp you could now add a test along the lines of

import spack.environment.depfile as df
from spack.spec import Spec

x, y, z = Spec("x"), Spec("y"), Spec("z")

model = df.MakefileModel(
    env_path="somewhere",
    roots=[x],
    adjacency_list=[
        df.DepfileNode(x, [y], df.UseBuildCache.AUTO),
        df.DepfileNode(y, [z], df.UseBuildCache.AUTO)
    ],
    make_prefix="test",
    pkg_identifier_variable="SPACK_PACKAGE_IDS",
    jobserver=False,
)

data = model.to_dict()

assert ... data["..."] ...

This is a version of the initial implementation I suggested in #36642 (comment), and has the same issue I described there: The unsafe nature of general spec formatting is not encoded into this solution and so it is easy to introduce special characters as part of spec.format or str(spec) (in spite of the _safe_name function you added here). In other words, if this were to merge, I would want the test I wrote in #36642 as it is currently written (validating the final makefile rather than an intermediate object).

You haven't directly responded to the follow-up suggestion I made in that comment - could you do that? Overall I like these changes, but don't find them specifically relevant to the problem that #36642 attempts to address.