fix(manifest): merge JVM facts components by coordinate

[Jeppe Fredsgaard Blaabjerg (jfblaa)]

What

• Merge .socket.facts.json components by coordinate. This drops the path-sensitive <coordId>#<hash> ids and resolvedAs, which only existed to reconstruct per-path subtrees.
• Write .socket.facts.json compact instead of pretty-printed.
• Record the generating CLI release as metadata.socketCliVersion, so a stale facts file can be told apart from fresh output.
• Add projects[].classpath to the compute-artifacts sidecar only. It lists the component ids resolved for each subproject across all of its configurations.
• Bump @coana-tech/cli to 15.10.55.

Why

Large JVM builds produced very large facts files, which made uploads slow and unreliable. A quick test of this restructure on a large build cut a facts file by roughly 80%. The Socket backend never used the per-path precision. Reachability does need each subproject's exact classpath, and the sidecar now carries it explicitly. It never goes into the uploaded file.

Release coordination

Requires @coana-tech/cli 15.10.55 (coana-tech/coana-package-manager#2482), which this PR bumps to. Coana's sidecar schema is strict, so earlier versions would reject the new classpath field. Don't release this without that bump.

Testing

• Unit tests cover:
  • one component where subprojects' subtrees differ
  • per-subproject classpaths across prod and test configurations
  • the sidecar classpath entries
  • the version stamp
• Ran a real Maven build on the compat fixture with the built CLI. The facts file has no hash ids and no resolvedAs, it carries socketCliVersion, and a module's sidecar classpath includes its sibling module.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes the JVM facts SBOM shape and the Coana sidecar contract for reachability classpaths; requires coordinated release with @coana-tech/cli 15.10.55.

Overview
JVM .socket.facts.json output is restructured so Maven, Gradle, and sbt manifests are much smaller: dependency components are merged by coordinate instead of path-sensitive coordId#hash ids, and projects[].resolvedAs is removed from the uploaded SBOM. When the same coordinate resolves with different subtrees across subprojects, one shared component now lists the union of child dependencies.

Facts files are written compact (not pretty-printed), and metadata.socketCliVersion is stamped when the built CLI inlines its version so stale artifacts are identifiable.

Reachability still needs each subproject’s full resolved classpath; that detail moves to the compute-artifacts sidecar only as projects[].classpath, built from new in-memory classpathByProject data during assembly. @coana-tech/cli is bumped to 15.10.55, which must accept the new sidecar field.

^{Reviewed by Cursor Bugbot for commit 87e4447. Configure here.}