feat(scan): scan selected uv workspace members with dependency graphs

[Martin Torp (mtorp)]

A shared uv.lock covers the whole workspace, so scanning it directly also pulls in unrelated members. Scanning a member's pyproject.toml on its own loses the lockfile's pinned versions.

This adds a --uv-members flag. Each TARGET is a member directory:

socket scan create --uv-members ./packages/api ./packages/worker

For each target, the CLI runs uv export --project <dir> in frozen, offline mode. uv finds the uv.lock in that directory or in its workspace root, so one scan can cover members of several workspaces. The CycloneDX SBOM keeps pinned versions and dependency relationships, including transitive workspace dependencies, all extras, and all dependency groups. Dependencies used only by dependency groups are marked as development dependencies by comparing an export with groups against one without. This needs uv with CycloneDX export support, which uv still treats as a preview feature.

Each SBOM is written as socket-uv-cdx.json beside the member's pyproject.toml, uploaded in place of manifest discovery, and removed after the scan, including on failure, Ctrl-C, or SIGTERM. The CLI stops if that file already exists. Because the file sits where the member's own manifest would, the regular upload roots and the reachability target work unchanged. handleCreateNewScan takes a generic generateScanFiles hook and has no uv-specific code. With --reach, which takes a single target, Coana analyzes only that member's directory.

Invalid targets and export failures stop the scan. --uv-members can't be combined with --auto-manifest or --dynamic-sbom-inference. The README and command help describe the option.

Validation:

• Source build, type checks, and lint on the changed files. Lint reports only the warnings the repo already has.
• 105 unit and CLI tests in the four touched test files.
• Six e2e tests against the real uv binary, run on both uv 0.10.9 and CI's uv 0.12.15. They cover pinned versions, dependency edges, extras, groups, development scopes, markers, exclusion of unrelated members, upload inputs, and cleanup. uv 0.12 leaves out dependsOn on leaf nodes and adds workspace-root dependency groups to members that don't define their own. The tests accept both.
• Live --reach scans against the Socket API with Coana 15.11.3, on a two-member workspace where app depends on requests 2.31.0 without calling it and other calls requests.get. --uv-members packages/app reported all 3 requests advisories as unreachable, and --uv-members packages/other reported all 3 as reachable. A regular scan of the whole workspace gave the same per-member results.
• Sending SIGINT or SIGTERM to the scan's process group mid-analysis removes the generated SBOM and keeps exit codes 130 and 143.

The depscan importer drops local workspace nodes without a purl. uv's uv:workspace:path values stay relative to the workspace root.