fix duplicate dependency analysis for workspace links

[tristanmanchester]

Summary

• ignore lockfile package entries that do not have a resolved version during duplicate dependency analysis
• add a regression test covering npm workspace link entries in package-lock data

Root cause

npm workspaces can appear in package-lock parsing as linked packages without a version. The duplicate dependency analyzer treated every package entry as a concrete installed version and passed an undefined version string into node:util styleText, which crashed analysis on Node 24.

Validation

• npm test -- src/test/duplicate-dependencies.test.ts
• npm run build
• linked the patched CLI into /Users/tristan/Projects/react-native-dotgrid and verified analyze now completes instead of crashing