Bomly smoke-test fixture: a pnpm workspace with a root dependency (ms), two members (apps/web, packages/lib) sharing pinned vulnerable dependencies (minimist@1.2.5, lodash@4.17.20), a workspace link dependency (web -> lib), and a member devDependency (left-pad).

Pinned by tag for deterministic goldens — do not update dependencies.