Preserve NuGet lock graph identity

[Widthdom]

Summary

• Preserve exact packages.lock.json package and dependency node locations, including UTF-8/CRLF-aware lines, columns, spans, and package end ranges.
• Scope NuGet package identity by lock file plus target framework/RID, retain the owning parent package for nested dependencies, and keep dependency candidate resolution file-local.
• Include dependency-lock edges in ordinary caller/callee traversal while suppressing package-name matches from file-level dependency graphs.
• Bump the dependency-lock extraction contract and reference-identity contract so existing databases refresh stale rows and candidates on the next normal index update.
• Document the behavior in both English and Japanese and add changelog.d/unreleased/4845.fixed.md.

Root cause

The lock-file extractor previously emitted approximate locations without a target qualifier or owning package for nested references. Candidate resolution then fell back to repository-wide name matches, which could bind identical package names across lock files and targets. Existing extraction and reference-identity contract markers also allowed stale persisted data to survive an update.

Validation

• dotnet restore CodeIndex.sln
• Release and Debug builds with -p:UseSharedCompilation=false: 0 warnings, 0 errors
• Full Release suite: net8.0 10,591 passed / 7 skipped; net9.0 10,118 passed / 419 skipped; 0 failures
• After the final origin/main sync: Issue Preserve package ownership, target scope, and source locations in packages.lock.json graphs #4845 tests passed on net8.0 and net9.0; dependency-lock tests passed 7/7 on each target
• dotnet run --project tools/CodeIndex.Changelog -- check (18 fragments validated)
• Refreshed the repository index from the final Debug build; status --check --json reports a fresh matching workspace with no failed checks

Adversarial review

Completed the two required adversarial review rounds. Round 1 identified a cross-file npm lock candidate fallback. Round 2 identified dependency-lock file-level false edges plus missing extraction/reference contract invalidation. All findings were fixed and covered by targeted regression tests; no review finding remains unresolved.

Fixes #4845