feat(lockfile): warn and keep packages when an optional field is unknown

[vibgrate-team]

Summary

Lockfile readers already kept the fields they understand and failed closed on truncated or invalid documents. An unknown optional key stayed in the dependency set with no warning.

vg now keeps that dependency set and prints one stable warning per file per unknown field name, for example:

pnpm-lock.yaml: unknown optional lockfile field "futureOptional"; continuing with the fields this version understands.

When the field name can't be shown safely, the line says (name omitted) instead. Field values, environment variables, and authorization headers are never printed. Formats with no optional field names (a Gradle lock line, a Gemfile spec, a go.sum line) still fail on an invalid line.

A shared helper in src/core-open/utils/lockfile-unknown.ts covers npm, pnpm, yarn, poetry, uv, pdm, Pipfile, Cargo, Composer, NuGet, Swift package pins, and pub, and is wired into src/engine/lockfile.ts and the dependency-graph scanner. New tests in src/engine/lockfile-unknown.test.ts lock in that rows are kept and the warning is emitted once.

Related issues

Closes #270

Checklist

• pnpm test passes
• pnpm lint is clean
• pnpm typecheck is clean
• Docs updated where behavior changed
• Determinism preserved
• No proprietary or internal references
• Commits use Conventional Commits and are signed off

How to verify

pnpm test
pnpm lint
pnpm typecheck