Fix Python groups and pnpm workspace lock validation

[renezander030]

deps-locked could miss Python development groups and accept a pnpm dependency found only in another workspace. It now reads the complete supported Python declaration tables and checks the pnpm importer belonging to the requested manifest.

• Parse Python manifests and lockfiles as TOML; include standard dependency groups, optional dependencies, legacy development dependencies, and all Poetry groups.
• Resolve normalized group includes and fail closed on malformed structures, unknown groups, duplicate normalized names, and cycles.
• Select the manifest's pnpm importer and discover shared ancestor lockfiles while respecting nested workspace boundaries. Preserve adjacent-lockfile precedence and legacy flat root locks.
• Include the selected shared lockfile in receipt snapshots, including when the policy lives in a nested package.
• Prepare version 0.13.1 with regression coverage and documentation.

Verification: 194 tests pass on Node 18, 20, and 22. Coverage passes the configured thresholds (93.88% lines, 83.19% branches, 97.58% functions); the dependency evaluator has 100% line/function coverage. Build, repository gates, diff checks, release-note extraction, and the packed npm artifact's Python/pnpm pass-block and receipt smoke tests pass.

Review notes: based on 1c74a5006ccdfb8283f56536c7bebea6fa8ff8c3. Changes cover dependency parsing/resolution, receipt inputs, regression fixtures, documentation, and package metadata; command matching, agent hooks, cryptographic features, and CI/release workflows retain their existing implementation. Adds the Node-18-compatible smol-toml parser. No release tag or package publication is included in this PR.