fix(drift): discover nested pyproject.toml and recursive package.json

[dyk1454683243-sudo]

What

loadAllDependencies now walks package.json and pyproject.toml with the same bounded recursive glob. Nested Python manifests (backend/pyproject.toml) and JS manifests more than one directory down (api/backend/package.json) are discovered; node_modules and other generated trees stay ignored. Root-only behavior and parsePyprojectDependencies semantics are unchanged. The entries.length ? entries : null contract is preserved — widening discovery is what keeps a partial list from switching the checker on.

Why

Fixes #206

A frontend package.json at the repo root plus a Python service in backend/ produced false DEPENDENCY_MISSING for FastAPI/Celery. The identical pyproject.toml at the root passed. */package.json had the same hole one level further down.

Type of change

• Bug fix
• New feature
• Refactor
• Docs
• CI/Tooling

How to test

1. Run npx vitest run test/checkers.test.ts
2. Confirm nested backend/pyproject.toml (fastapi/celery) and api/backend/package.json claims pass, while undeclared packages still warn
3. Confirm existing root-only dependency tests still pass
4. Run npm run typecheck and npm test

Checklist

• Tests pass (npm test)
• No breaking changes
• Tested locally with a real project

Code-graph changes

• This PR targets main
• A linked issue agrees on the bounded extractor/resolver scope
• The change follows the frozen LanguageExtractor or FrameworkResolver interface
• A focused fixture and assertions for the expected node/edge shape are included
• Any new grammar WASM, extension mapping, extractor, or resolver is registered
• No graph identity, reconciliation, schema, or drift-semantics changes are included, or a core / discuss-first issue is linked above