feat: scan all package.json files in non-workspace target repos

[pyramation]

Summary

Extends makage update-deps --in <target> to recursively discover all package.json files when the target repo has no pnpm-workspace.yaml, instead of only checking the root package.json.

This enables dependency detection in boilerplate/template repos like sandbox-templates and pgpm-boilerplates, which have multiple independent template directories each with their own package.json (and sometimes their own lockfile) but no pnpm workspace configuration.

Before: non-workspace targets only checked package.json at the repo root.
After: non-workspace targets glob for **/package.json (excluding node_modules), discovering all nested templates.

Review & Testing Checklist for Human

• Verify that glob('**/package.json') from the glob library matches the root package.json as well (unlike git pathspecs where ** only matches subdirectories). If it doesn't, the root would be silently skipped in non-workspace repos.
• After publishing, test against the actual repos: makage update-deps --from ./constructive --in ./sandbox-templates and makage update-deps --from ./constructive --in ./pgpm-boilerplates to confirm nested templates are discovered and outdated deps are detected.
• Consider whether deeply nested package.json files in unexpected places (test fixtures, examples, etc.) could cause false matches. Currently only node_modules is excluded.

Notes

• Workspace-based target repos (with pnpm-workspace.yaml) are unaffected — the existing workspace-aware path is tried first.
• This is a prerequisite for adding boilerplate repo updates to the update-constructive-deps workflow.

Link to Devin session: https://app.devin.ai/sessions/08781f0838fd4c929bb5ab08052b2b5a
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring