fix(workspace): attribute files to nearest package.json, not glob-matched intermediate dirs

[BartWaardenburg]

DRAFT - Review verdict: FIX. This PR is opened as a draft because the reviewer flagged two blocking clippy lints, a scope alignment question, and missing real-world validation. The items below must be resolved before this can be merged.

Summary

Adds owning_workspace_root and nearest_undeclared_package_json_deps helpers in crates/core/src/analyze/unused_deps.rs. When a source file lives inside a glob-matched intermediate workspace (e.g. packages/themes) but is closer to its own package.json (e.g. packages/themes/my-theme/package.json) that was not expanded by the shallow glob (e.g. ./packages/*), is_package_listed_for_file now walks upward from the file to find that nearer manifest and uses its declared dependencies instead of the intermediate workspace's deps. This eliminates false unlisted-dependency findings for packages correctly declared in nested manifests that a shallow glob never discovers as workspace entries.

Review

Verdict: FIX

Concerns from review:

• BLOCKING - CI clippy gate will fail (two -D warnings lints):
  • clippy::doc_link_with_quotes at unlisted_deps.rs:939: the doc-comment line (workspaces: ["./packages/*"]) is parsed as an intra-doc link; wrap in backticks.
  • clippy::redundant_clone at unlisted_deps.rs:991: themes_dir.clone() is redundant because themes_dir is dropped after; drop the .clone().
• Scope alignment question: The issue states the intermediate dir packages/themes has NO package.json (a phantom glob match). expand_workspace_glob already skips dirs without a package.json (see GlobMatchedNoPackageJson diagnostic). This fix instead handles the case where packages/themes HAS a package.json but a deeper non-workspace packages/themes/my-theme/package.json was missed by the shallow glob. That is a real scenario, but should be confirmed against the actual reporter's repo before merge.
• No real-world validation: CLAUDE.md requires a minimal repro test, a real project run, and the full suite for any bug fix. Only a synthetic unit test (with a hand-built ws_dep_map) exists; the real find_unlisted_dependencies + workspace-discovery pipeline has not been validated against the targeted layout.
• Minor (non-blocking): nearest_undeclared_package_json_deps reads and parses package.json from disk per ancestor on every (package, file) call with no caching, and runs inside the perf-priority audit/unlisted loop. Worth a comment or memoization note.
• Minor (non-blocking): The ws_dep_map.iter().any(...) break at unlisted_deps.rs:85 is effectively dead since owning_workspace_root already returns the deepest tracked workspace. Harmless but slightly misleading.

Closes #842