fix(parsers): nested lockfile selection ignores packageManager, and --debug reads the root instead of the selected lockfile #1514

Note: this is an in-house item already being handled by the maintainer - not open for contribution. Filed for tracking only.

What happens

When the scan root has no lockfile and a single nested folder holds lockfiles from two package managers, nested discovery picks one by a fixed filename order and never reads that folder's packageManager field. Root selection does read it.

After #1495 the nested order ranks npm-shrinkwrap.json and then package-lock.json ahead of pnpm-lock.yaml. So a pnpm project in a nested folder that still carries a stale npm lockfile is scanned from the npm file. If the vulnerable packages are only in pnpm-lock.yaml, the scan reports them as clean and exits 0 under --fail-on, even when the folder's package.json declares packageManager: pnpm.

This predates #1495: a stale package-lock.json already outranked pnpm on this path. #1495 extended the same blind spot to the shrinkwrap. Found by CodeRabbit on #1506.

Also reading the scan root instead of the selected lockfile

The --debug bundle derives the package manager, the lockfile version and the npm link-entry count from files at the scan root, not from the lockfile the scan actually read:

• A scan that selects a nested lockfile reports packageManager: "unknown" and lockfileVersion: null in environment.json.
• When the root declares pnpm and a stale npm-shrinkwrap.json is also present, project.json can carry an npm link-entry count for a pnpm run.

Done when

• A nested folder is selected by the same rules as the root, including packageManager and shrinkwrap precedence, reusing the shared root selection from fix(overrides): read the lockfile the scan selected #1506.
• A nested folder with a vulnerable pnpm-lock.yaml, a clean npm-shrinkwrap.json and packageManager: pnpm exits 1 under --fail-on high.
• The debug bundle's package manager, lockfile version and link-entry count come from the lockfile the scan selected.