Fix split-version uv dependency scope traversal after PR #2492 #2514

Follow-up to the post-merge review on #2492: #2492 (comment).

Current main f258db8a6cc38c064ba4d7ca1baee02bedbd0534 still traverses uv dependencies by name. A lock with runtime split@1.0, development-only split@2.0, and split@2.0's dev-child@1.0 incorrectly marks all three runtime. The evidence recorder shares this classifier and accepts the incorrect rows.

Acceptance:

• Preserve locked name/version/source identity and requested extras through traversal, directness, scope assignment, and emitted dependency edges.
• Keep split@1.0 runtime and split@2.0 plus its exclusive child development.
• Cover same-version/different-source packages, scope-specific extras, cycles, and unresolved/ambiguous references.
• Reject incorrect API scope rows before writing evidence, using literal regression expectations independent of classifier output.
• Deliver a tested draft PR and distinguish local tests from hosted CI. Do not merge automatically.

This is a classification correction, not a newly discovered vulnerability or production-exposure claim. The original repair is merged; this issue does not reopen GRV-861 or redo that completed work.

A focused four-file patch has passed 55 local tests, Ruff, and git diff --check. Its tested tree is 195f14846513dffb4943f862a59fbe42b0d9d12c; draft PR follows.