Preserve lockfile dependency provenance

[MikeeI]

Summary

Project dependency pins only from the lock artifact that owns each dependency record.
Remove false cross-workspace LOCKS relationships.

Evidence

• JSON records already preserve manifest or lockfile ownership.
• Neo4j currently fans every locked dependency out from every application lockfile.

Changes

• Resolve direct records through their manifest's sibling lock.
• Use the recorded lock artifact directly for lock-only records.

Risks and boundaries

• Package identity and relationship schema remain unchanged.
• Multiple sibling lockfile precedence remains out of scope.

Verification

• bun test test/artifacts.test.ts
• bun test
• bun run typecheck

I checked the relevant issues, comments, pull requests, and discussions; this pull request is not a duplicate.

Disclosure

Investigated thoroughly with GPT-5.6 at extra-high reasoning effort.
I used Oh My Pi as the agent framework.
This report is not generic or unreviewed AI-generated output.
Its claims were checked against the cited evidence.
It includes the relevant detail intended to help maintainers resolve the issue.
If reports like this are not useful to the project, please let me know.
I will refrain from submitting similar reports.
My intent is to help without wasting maintainer time or energy or discouraging their work.
Thank you for your work.