Bomly smoke-test fixture: an npm workspace with a root dependency (ms), two members (apps/web, packages/lib) that share a pinned vulnerable transitive dependency (minimist@1.2.5, lodash@4.17.20), a workspace link dependency (web -> lib), and a member devDependency (left-pad).

Pinned by tag for deterministic goldens — do not update dependencies.