fix(go): merge children on MVS version key collision instead of overwriting

[ruromero]

Summary

• Fix HashMap.put() collision in getFinalPackagesVersionsForModule() that dropped transitive dependencies when multiple parent module versions remapped to the same MVS-selected version
• Replace put() with merge() using LinkedHashSet to combine children lists while deduplicating
• Add reproducer test confirming 138 components (matching JS client), up from 134

Implements TC-4127

Test plan

• Reproducer test Test_Golang_MvS_Enabled_Preserves_All_Transitive_Dependencies passes (138 components)
• Existing Test_Golang_MvS_Logic_Disabled passes (5 opencensus versions disabled, 1 enabled)
• All 6 parameterized test_the_provideStack + test_the_provideComponent tests pass
• All Go module tests pass (12/12 in surefire)
• Spotless formatting clean

🤖 Generated with Claude Code

[ruromero]

Verification Report for TC-4127 (commit b4bcfa9)

Check	Result	Details
Review Feedback	N/A	No reviews or comments on the PR
Root-Cause Investigation	N/A	No sub-tasks created
Scope Containment	PASS	8 files changed: 1 source fix + 1 test + 6 expected SBOM fixtures — all in scope
Diff Size	PASS	+1490 / -1073 across 8 files — proportional (bulk is regenerated JSON fixtures)
Commit Traceability	PASS	All 3 commits reference TC-4127 in message body
Sensitive Patterns	PASS	No passwords, secrets, API keys, or .env references found
CI Status	PASS	38/38 checks pass (build, unit tests, integration tests across ubuntu/macos/windows × all ecosystems)
Acceptance Criteria	PASS	See details below
Test Quality	PASS	New test has Javadoc and given-when-then structure; no repetitive test candidates
Verification Commands	N/A	No verification commands in task

Acceptance Criteria Detail

#	Criterion	Result
1	HashMap.put() replaced with merge() + LinkedHashSet in getFinalPackagesVersionsForModule()	PASS — line 357 of GoModulesProvider.java
2	Reproducer test asserts 138 components (matching JS client)	PASS — Test_Golang_MvS_Enabled_Preserves_All_Transitive_Dependencies at line 228
3	All existing Go module tests pass	PASS — 38/38 CI checks green
4	Expected SBOM fixtures updated to reflect corrected output	PASS — 6 fixtures regenerated with correct component counts

Overall: PASS

All checks pass. CI is fully green across all platforms and ecosystems.

---

This comment was AI-generated by sdlc-workflow/verify-pr v0.6.1.