fix: prune devDependencies of virtualized workspaces under --prod (#256)

[RickTimmer]

Description

Under --prod, devDependencies of workspaces leak into the SBOM when the workspace is virtualized.

A workspace on the resolution path of a peer dependency is resolved by Yarn as virtual packages, each with its own locatorHash and copy of the dependencies map — this happens even when no workspace manifest declares peerDependencies, since a transitive npm dependency declaring a peer is enough. The SBOM traversal walks those virtual instances, but the previous --prod prune only mutated the scanned workspace's anchoredPackage, so dev edges on the virtual copies survived and their targets were emitted as production components.

This PR prunes across project.storedPackages, devirtualizing each locator (structUtils.devirtualizeLocator + tryWorkspaceByLocator) so dev edges are removed from every workspace instance including virtual copies. Edges are removed rather than components filtered by identity, so a package that is a devDependency of one workspace but a genuine transitive prod dependency elsewhere is correctly retained.

This also covers the case #456 misses: that PR filters by ident on anchored workspace packages, which never match virtual instances (different locatorHash, virtual:-prefixed reference).

Adds a regression testbed (workspace-peer-dev-dependencies) where a child workspace is virtualized via a transitive peer (use-sync-external-store → react) with no workspace-level peerDependencies, carrying a dev-only is-number; snapshots assert is-number is absent under --prod and present without it. Also verified against a real-world Yarn Berry monorepo.

Resolves or fixes issue: #256

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: Claude (claude.ai)
  • LLMs and versions: Claude Opus 4.8
  • Prompts: e.g Diagnosing why --prod includes transitive workspace devDependencies, Generate test-suite for this case, and fill in this PR description form

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[jkowalleck]

@RickTimmer please sign off your commits as described in the contribution guidelines: https://github.com/CycloneDX/cyclonedx-node-yarn/blob/main/CONTRIBUTING.md#sign-off-your-commits

you may do so after the fact by following these instructions: https://github.com/CycloneDX/cyclonedx-node-yarn/pull/563/checks?check_run_id=88771998480

[jkowalleck]

before accepting that change, we need the testsbeds running in the unpatched version - to then showcase the effect of the fix.

Could you open an additional pullrequest that just adds the testbed and no source changes?
I will then have this merged first, so we see in the diff, how your code changes affect the results/snapshorts.

[RickTimmer]

Sounds good thanks for the quick look. I made the new PR here, this one contains just the test beds. That was a good suggestion on your part.

#564