Test: add Cargo workspace / path-dependency fixture for vg build

[vibgrate-team]

Context

Rust workspaces with path dependencies are common. We want a small, pinned fixture so vg build graph extraction for Cargo stays deterministic across releases (CONTRIBUTING: same input → same graph.json).

Rewritten from adjacent SBOM/ecosystem gaps in the wild (workspace/path edge cases) — Vibgrate-specific fixture work only.

What to do

1. Add a tiny Cargo workspace under test/ (or existing fixture layout) with at least one path dependency and a lockfile.
2. Assert stable graph output (content-hashed IDs / stable sorts) for vg build (or pnpm dev build) on that fixture.
3. Document how to re-run the fixture in a one-line comment or test name.

Acceptance

• Fixture is tiny and checked in (no network at test time)
• Test fails if path-dep edges disappear or order drifts
• pnpm test green locally
• DCO sign-off

Refs: CONTRIBUTING language/fixture guidance · roadmap #144