detect: follow up on PR #83 dependency review comments

[davidahmann]

Problem

PR #83 introduced two review concerns in dependency detection:

1. ignored directories were filtered after full traversal, still paying walk cost on large trees
2. project signal fallback used substring matching and could produce noisy false positives

Changes

• Traverse repository with detector-local walk and skip ignored directories during traversal (SkipDir) before descending.
• Collect only dependency manifest candidates during walk for deterministic lightweight scanning.
• Switch project-signal heuristic to token-boundary keyword matching for repo/readme text.
• Add dependency detector tests covering:
  • unreadable ignored directory handling
  • no false positive on storage/management text
  • positive signal on explicit keyword token

Validation

• go test ./core/detect/dependency -count=1
• go test ./core/detect/... -count=1
• make prepush-full
• ./.tmp/wrkr scan --path ./scenarios/wrkr/scan-mixed-org/repos --json > .tmp/pre-ship-scan-pr83-followup.json