fix(workspace): discover packages nested under a bare glob-matched intermediate dir

[BartWaardenburg]

Summary

Fixes the false unlisted-dependencies (e.g. react) reported for packages nested under a bare workspace-glob intermediate directory.

When a root package.json declares a single-level glob such as "workspaces": ["packages/*"] but a real package lives two levels deep (packages/themes/my-theme/package.json, where packages/themes itself has no package.json), the glob only matched the bare packages/themes directory. The deep package was never discovered, so its files fell back to the root manifest and every dependency it correctly declared surfaced as unlisted.

Approach (re-scoped to workspace discovery)

The fix lives in workspace discovery (crates/config/src/workspace/parsers.rs), not analysis-time dependency attribution. When a workspace glob matches a directory that has no package.json of its own, expand_workspace_glob_with_diagnostics now descends exactly one level via recover_nested_packages and registers any immediate child that is a real, named package, in the same shape the discovery loop already consumes. So the deep package becomes a normal discovered workspace and feeds ws_dep_map, and unused-files / unused-exports / boundary checks all see one consistent owning package.

Recovery is conservative: node_modules and conventional skip-list directories (build output, caches, hidden dirs) are excluded, and a manifest without a name (fixtures, build artifacts, __mocks__) is rejected. When at least one child is recovered the glob-matched-no-package-json diagnostic is suppressed; when none is, it still fires.

Tests

• expand_workspace_glob_recovers_nested_package_under_bare_intermediate (config): proves the named deep package is recovered while a nameless manifest and a non-package dir under the same grouping dir are not.
• discover_workspaces_recovers_package_under_bare_glob_intermediate (config): end-to-end discovery reconstructing the reporter's exact workspaces: ["./packages/*", "./themes/*"] array, asserting metrists-theme-next becomes a discovered workspace (it is not on main).

Full fallow-config workspace suite + full fallow-core suite pass; clippy -D warnings, fmt, and the agent-file manifest gate are clean.

Note

This replaces the earlier analysis-time attribution approach, which a panel review found did not change the reporter's output (its helper only ran when the intermediate dir was itself a tracked workspace, which it is not in the reporter's layout). The fix now reproduces and resolves the reporter's actual case.

Closes #842

[github-actions]

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Fallow Benchmarks'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.50.

Benchmark suite	Current: d56eb86	Previous: 2df7aae	Ratio
dupe_detect_2x500_identical	236921 ns/iter (± 4784)	156496 ns/iter (± 2359)	1.51
dupe_detect_2x2000_identical	1079788 ns/iter (± 11967)	714903 ns/iter (± 6355)	1.51
dupe_detect_100x200_mixed	4382385 ns/iter (± 29091)	2919083 ns/iter (± 30803)	1.50
dupe_detect_2x5000_identical	3005720 ns/iter (± 6078)	1966738 ns/iter (± 21340)	1.53

This comment was automatically generated by workflow using github-action-benchmark.

[BartWaardenburg]

Landed on main via maintainer direct-to-main flow, squashed into ae240a0. #842 is fixed on main; closing as redundant.