[Janil-ship-it]

Pull Request

Summary

Refreshes docs/sbom-dependency-scope.md to reflect recent engine changes:

• Updated the Cargo.lock mapping row, Cargo example paragraph, and Gap 8 to state that crates without a source (the root package, path dependencies, and workspace members) are skipped.
• Updated the poetry.lock / uv.lock mapping row to state that packages with editable or virtual sources are skipped.

Related issues

Closes #554

Checklist

• pnpm test passes
• pnpm lint is clean
• Docs updated where behavior changed
• Commits use Conventional Commits and are signed off (git commit -s, DCO)

[vibgrate-team]

Automated review: passed. The updated Cargo.lock and poetry.lock / uv.lock rows, the Cargo example and gap 8 all match how src/engine/lockfile.ts behaves on main today (sourceless crates and editable or virtual Python packages are skipped). A maintainer will take a final look soon. Thanks for keeping the docs accurate!