Bound dependency snapshot scans for lockfile-only PRs #2476

Problem

Dependency-review jobs for lockfile PRs #2464 and #2465 timed out after ten minutes in Submit dependency snapshots. The component detector resolved unrelated Python requirements across the repository; the Dependency Review step never ran. This leaves otherwise passing PRs without a security review result.

Completion criteria

• For PRs changing only uv.lock/root pyproject.toml or npm lockfile pairs, stage and scan the relevant lockfiles and adjacent manifests without resolving unrelated requirements.
• Preserve the full snapshot path for mixed or unsupported dependency changes and pushes to main; keep the existing dependency review severity and license policy.
• Verify on hosted CI that the focused scan submits a usable head snapshot, the dependency review action reports real additions, and the workflow completes within its ten-minute limit.
• Rerun exact-head checks on fix: bump locust from 2.46.0 to 2.47.0 #2464 and fix: update anthropic requirement from <2,>=0.105.0 to >=0.105.0,<3 #2465 after the workflow fix reaches main; confirm the timeout is gone before treating either PR as merge ready.

The workflow repair PR should close this issue when merged. This does not waive the remaining review or compatibility checks on those PRs.