fix: Remove extraneous bun.lock entries during prune (#13317)
### Why
`turbo prune --docker` could produce a `bun.lock` that `bun install
--frozen-lockfile` rejects with `error: lockfile had changes, but
lockfile is frozen`, breaking Docker builds of pruned bun monorepos.
Fixes #13310
### What
Two fixes in bun lockfile pruning
(`crates/turborepo-lockfiles/src/bun/subgraph.rs`):
1. **Dangling verbatim keys**: when re-adding a nested dependency whose
source entry lives in an ancestor scope, the verbatim source key was
inserted even when its entire scope chain was pruned away (e.g.
`@expo/cli/ora/chalk` while `@expo/cli` is gone, pulled in from a pruned
workspace's tree). Nothing can resolve to such a key, so bun's clean
pass strips the package and the frozen install fails. The entry is now
nested under the dependent instead, which also makes the dependent
resolve the version it was actually locked to.
2. **Unreferenced packages**: a final sweep now emulates bun's lockfile
clean pass by walking every dependency edge from the workspaces using
bun's scope-walking name resolution, and dropping packages whose
resolution is never referenced. Keys of referenced packages are kept
even when the individual key is unreferenced, matching bun's row-level
(not key-level) semantics.
Also extracts the existing nested-entry deduplication into a named
function, adds the issue reproduction as a `check-lockfiles` fixture
(`bun-v1-issue-13310`), and excludes `lockfile-tests/fixtures/` from
oxfmt since reformatting fixture `package.json` files (key reordering)
breaks package-manager validation against the committed lockfile.
### How to test
```
cargo build -p turbo
cd lockfile-tests
pnpm check-lockfiles --fixture bun-v1-issue-13310
```
The new fixture fails validation on `main` (bun cleans 4 unreferenced
packages from the pruned lockfile) and passes with this change. All 69
bun fixture targets and all 253 `turborepo-lockfiles` unit tests pass.
One synthetic unit test was updated: it asserted that alias-style keys
(`react-19`) survive pruning even though nothing references them by
name; bun's clean pass would strip those, and real lockfiles key
overridden dependencies under the dependency name.
