feat: workspace package-name resolution for JS/TS imports (2/3)

[NehharShah]

What

Second PR of the issue-3 stack (stacked on #34 — merge that first, then retarget/rebase this to main). Workspace package imports (@acme/core, @acme/core/sub) now resolve to their workspace dirs. Globs come from package.json workspaces (npm array and yarn {packages: [...]} forms) and pnpm-workspace.yaml packages: lists; a matched dir counts only if its own package.json carries a name.

Why

Part of #3 (PR 2/3 of the stacked plan)

Resolution order per the issue: relative → paths alias → workspace name → drop. Globs match segment-wise (* spans one path segment, ** spans any number) so packages/* cannot swallow nested example packages. Subpath imports ground inside the package dir when the path exists there, else fall back to the package dir itself (exports maps are not modeled — package-level edge is still correct).

Testing

• 10 new tests: npm/yarn/pnpm discovery, the pnpm packages: list parser, segment-glob safety (* vs **), nameless workspaces ignored, workspace-name edges, subpath ground-or-fallback, and paths-beats-workspace precedence
• Full suite: 76 tests, all green
• Dogfood: repokg generate . --no-github + repokg clean round-trips clean

Checklist

• Branch is named issue-<N>/<short-description>
• Zero new runtime dependencies (stdlib only)
• Heuristics register findings with confidence + evidence (JS/TS finding upgrade lands in PR 3/3 per the stacked plan)
• New artifacts are reversed by repokg clean (no new artifacts)
• Tests added/updated and python -m unittest discover -s tests passes