fix: scan and build read package metadata only from the given path

[vibgrate-team]

Summary

vg scan <path> and vg sbom export --root <path> already read the project at <path>. vg build <path> did not, when <path> was a directory outside the working directory.

vg build ../other treated that directory as a discovery scope of the working directory. The build then read the cwd lockfile and config, and the ignore matcher threw on ../other/package-lock.json (path should be a path.relative()d string). A single directory outside the working directory is now the project that is mapped: its lockfile, node_modules, and config are the ones that are read, and artifacts are written for that directory. A path inside the working directory stays a scope (vg build src still uses the repo's lockfile and config).

Regression tests run vg scan, vg build, and vg sbom export from a decoy working directory against a sibling project with different lockfile versions, node_modules versions, and driftBudget / exclude settings. Output matches a run from inside the target, decoy markers do not appear, and .vibgrate/ artifacts are not written under the decoy.

Related issues

Fixes #377

Checklist

• pnpm test passes
• pnpm lint is clean
• pnpm typecheck is clean
• Docs updated (README / DOCS / ARCHITECTURE) where behavior changed
• Determinism preserved — identical input still produces identical graph.json / report output (content-hashed IDs, stable sorts; no time, randomness, or filesystem-order dependence)
• No proprietary or internal references — public, Apache-2.0 content only
• Commits use Conventional Commits and are signed off (git commit -s, DCO)

Notes for reviewers

pnpm lint exits 0. It still reports five unused-variable warnings in files this change does not touch.

Scan JSON is compared as data, not bytes: extended scanners finish concurrently, so object key order can differ between two runs of the same tree. Progress lines on stderr include elapsed time; the test rewrites those durations before comparing. graph.json is compared byte for byte with --generated-at pinned.