Fix vlt 1.4 pnpm-workspace.yaml members (#1564) (#1574)

* Start fix for #1564

Assisted-by: Claude Code:claude-opus-5-5

* Test vlt 1.4 pnpm-workspace.yaml members (#1564)

vlt 1.4 installs a member listed by the root pnpm-workspace.yaml
packages: from the root vlt-lock.json when neither vlt.json nor
package.json declares workspaces. These tests show hosted, vendored
and VEX runs from such a member treating it as its own project, and
pin the vlt 1.3.8 and precedence controls that must stay as they are.

Assisted-by: Claude Code:claude-opus-5-5

* Refuse vlt 1.4 pnpm-workspace.yaml members

vlt 1.4 lists workspace members from the root pnpm-workspace.yaml
packages: when neither vlt.json nor package.json declares workspaces,
and installs them from the root vlt-lock.json. socket-patch read only
the first two sources, so hosted and vendored scans from such a member
rewrote a lock vlt never reads and exited 0, and vendored VEX attested
not_affected while vlt installed the unpatched package.

The vlt root lookup now reads the third source. vlt 1.3.8 and older
ignore the file, so its directories count as members only when the
root lock has an edge from one of them, which only vlt 1.4 writes.
Hosted, vendored and VEX runs share the lookup.

Fixes #1564

Assisted-by: Claude Code:claude-opus-5-5

* Walk past an uninstalled pnpm workspace file

A pnpm-workspace.yaml with no vlt-lock.json beside it, such as a
vendored pnpm sub-monorepo, is not shown to be vlt's, so it no longer
stops the search for an outer vlt.json root that installs the member.
Also shares one helper for vlt's per-group glob check and fixes the
refusal code's doc.

Assisted-by: Claude Code:claude-opus-5-5

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: mikolalysenko