Add pnpm-lock.yaml parser (#15)

Vibe-coded apps from platforms like v0/Bolt/Lovable often ship with
pnpm-lock.yaml, which the connector previously rejected with
LOCKFILE_UNSUPPORTED. This adds a zero-dep parser that handles every
common pnpm lockfile format (v5 slash-separated, v6-v8 leading-slash with
`@`, v9 unquoted/quoted keys with `(peer)` suffixes) and marks direct
dependencies from either `importers:` (v9) or top-level dependency
sections (v6-v8 single-project lockfiles).

Detection routes pnpm before yarn so an in-progress yarn migration with
both lockfiles present still works.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

Author: ejntaylor

README.md

@@ -114,10 +114,10 @@ That's the entire payload. No source code, no environment variables, no file pat
 ## Supported lockfiles
 
 - ✅ `package-lock.json` (npm v6 / v2 / v3) — parsed directly
+- ✅ `pnpm-lock.yaml` (pnpm v5 / v6 / v7 / v8 / v9) — parsed directly
 - ✅ `bun.lockb` (binary) — package list resolved by walking `node_modules/`
 - ✅ `bun.lock` (text) — same fallback; direct parsing coming
 - ❌ `yarn.lock` — coming soon
-- ❌ `pnpm-lock.yaml` — coming soon
 
 If both a Bun lockfile and `node_modules/` are present, the connector walks `node_modules/` to enumerate the installed packages. Run `bun install` (or `npm install`) before scanning so the directory is populated.