fix(sbom): address review feedback for uv hash extraction

- Log errors when uv.lock cannot be read or parsed instead of silently
  ignoring, so issues are discoverable during troubleshooting
- Align JSDoc graph parameter type with GraphEntry typedef
- Skip hash assignment when entry already has hashes to avoid
  overwriting data from other pipeline stages

Implements TC-4332

Assisted-by: Claude Code

Author: a-oren

src/providers/python_uv.js

@@ -41,20 +41,22 @@ export default class Python_uv extends Base_pyproject {
 	/**
 	 * Parse uv.lock and attach SHA-256 hashes to graph entries.
 	 * @param {string} lockFilePath - path to uv.lock
-	 * @param {Map<string, {name: string, version: string, children: string[]}>} graph
+	 * @param {Map<string, import('./base_pyproject.js').GraphEntry>} graph
 	 */
 	_attachHashesFromLockFile(lockFilePath, graph) {
 		let lockContent
 		try {
 			lockContent = fs.readFileSync(lockFilePath, 'utf-8')
-		} catch {
+		} catch (e) {
+			console.error(`uv: could not read lock file ${lockFilePath}: ${e.message}`)
 			return
 		}
 
 		let parsed
 		try {
 			parsed = parseToml(lockContent)
-		} catch {
+		} catch (e) {
+			console.error(`uv: could not parse lock file ${lockFilePath}: ${e.message}`)
 			return
 		}
 
@@ -68,7 +70,7 @@ export default class Python_uv extends Base_pyproject {
 
 			let key = this._canonicalize(pkg.name)
 			let entry = graph.get(key)
-			if (!entry) { continue }
+			if (!entry || entry.hashes) { continue }
 
 			entry.hashes = [{alg: "SHA-256", content: hashStr.slice(7)}]
 		}