Enhancement: keep direct dependencies without explicit version pins visible in vg scan graphs

[vibgrate-team]

Context

Some manifests declare direct dependencies without a concrete version pin (workspace inheritance, catalog refs, or omitted version fields). Adjacent analyzers have dropped those edges entirely. For Vibgrate, vg build / vg scan should still record that the direct edge exists — with an honest “unpinned / inherited” representation — so impact and drift stay trustworthy and local-first.

What to do

1. Pick one supported ecosystem where unpinned/inherited directs already appear (or are closest) — e.g. npm workspace, pnpm catalog, or Cargo workspace — matching what the codebase already parses.
2. Ensure the graph retains a deterministic node/edge for the direct dependency instead of omitting it.
3. Human and machine output should not invent a fake version; prefer explicit absence or an inherited marker already used elsewhere.
4. Add a fixture + test asserting the direct edge survives.

Acceptance

• Direct unpinned/inherited deps remain visible in graph/scan output for the chosen ecosystem
• No fabricated version numbers; absent stays absent (not 0 / empty string hacks)
• Deterministic graph for the fixture
• DCO sign-off on commits (git commit -s) if the PR touches the repo

Mentoring notes

One ecosystem per PR. Do not boil the ocean across all languages. Align with absent-vs-zero themes (#160) for any numeric/score fields you touch.