Extend platformos-graph to manage project structural/dependency model for supervisor

[fklosowski]

Extend platformos-graph: dependency edges, per-file extraction, CLI, web-component removal

Summary

Extends @platformos/platformos-graph so it can model the full platformOS dependency surface and expose it both as a CLI and as a per-file primitive — the structural model the rebuilt MCP supervisor will consume (TASK-9). Also removes the dead Shopify-era web-component machinery, modernizes the CLI, and hardens everything for Windows CI.

What changed

1. Richer dependency edges (TASK-9.1)

traverseModule previously extracted only {% render 'literal' %} and asset filters. It now resolves the full set of Liquid dependency constructs, each tagged with a semantic ReferenceKind:

• {% render %} / {% include %} (distinguished as render vs include)
• {% function %} (commands/queries/lib helpers)
• {% background %} (file-based form)
• {% graphql %} (.graphql operation files)
• asset filters (asset_url, asset_img_url, inline_asset_content)

All targets resolve through check-common's DocumentsLocator, so lib search paths, modules//public/... prefixes, and .liquid / .html.liquid extensions are handled uniformly —
commands/queries/graphql files are now first-class nodes. ReferenceKind is an additive, optional field on Reference; the LSP consumers (platformos_references / dependencies / dead_code)
were re-verified.

2. Per-file extraction primitive — extractFileReferences (TASK-9.3)

The visitor/resolution logic was factored into a single shared resolveLiquidReferences, used by both the full-project traversal and a new public primitive:

extractFileReferences(rootUri, sourceUri, sourceCode, { fs }): Promise<Reference[]>

It returns one file's resolved outgoing edges without building the whole graph, parsing an in-flight buffer (not disk) — the model a validate_code-style tool needs ("validate before
writing"; the file may not exist yet). Per-file and project-wide resolution share one code path, so they can't drift. Supervisor wiring guidance recorded in backlog TASK-9 / TASK-9.3.

3. New CLI (bin/platformos-graph)

The old bin referenced non-existent Shopify packages and an undeclared dependency. Rewritten as a thin wrapper over a testable cli.ts core:

• platformos-graph → whole serialized graph
• platformos-graph [file] → a single file's dependencies + references
• Self-contained node AbstractFileSystem (no runtime dep on platformos-check-node)
• Validates the project root via findRoot — a typo'd/non-platformOS path fails loudly instead of silently emitting an empty graph
• fs-injectable for hermetic testing

4. Removed web-component (Path B) machinery

Deleted getWebComponentMap.ts, the visitor, WebComponent* types, the getWebComponentDefinitionReference dependency, and 'web_component' from ReferenceKind — cross-package
(graph + LSP AppGraphManager). platformOS doesn't use customElements.define; this was inherited dead code.

5. Cross-platform / CI hardening

• URI normalization in the by-URI module factories (getPartialModuleByUri / getGraphQLModuleByUri) — DocumentsLocator returns unnormalized URIs that keep backslashes on Windows, breaking
  graph-key matching; now normalized to forward slashes.
• Fixed a Windows CI timeout: the project-root-validation test walked the real filesystem; reworked to inject an in-memory fs (deterministic, instant, OS-independent).
• Skip Playwright Chromium download during yarn install (Node 24 install hang).
• Removed the now-dead acorn-walk dependency and synced yarn.lock (--frozen-lockfile safe).

6. Test quality

• New edge fixtures (function-edges, graphql-edges, include-edges, background-edges, module-edges) and exact whole-object/array assertions per the repo's Test Assertion Guidelines.
• Type/correctness fix surfaced by the new tests: SerializableEdge was under-typed as {source,target} but the serializer always emits full References (with type/kind); corrected to
  SerializableEdge = Reference.

Verification

• Graph suite 35 passing; check-common and LSP consumers re-verified and type-check clean.
• Behavior-preserving refactors confirmed by unchanged build/traverse-edges specs.
• yarn install --frozen-lockfile passes; prettier clean.
• Targets both CI matrices (ubuntu + windows, Node 22/24).

Follow-ups (tracked in backlog, not in this PR)

• Self-structural names (filters/tags/translation_keys/doc_params/slug/layout/method) — remainder of TASK-9.3.
• Project-structure query API + incoming-reference caching — TASK-9.2.
• Supervisor consumption of extractFileReferences — TASK-9 (wiring guidance recorded).