fix(engine): objective-anchor's unanchored "dependency" regex over-matches beyond package.json/package-lock.json

[JSONbored]

⚠️ Definition of Done: this issue must be completed in full, in a single PR. Do not split this
work across multiple PRs, and do not defer any Deliverable below to a follow-up issue. A PR that
satisfies only some of the Deliverables, stubs a required test, or leaves a checkbox
partially-done does NOT resolve this issue and will be closed.

Context

packages/loopover-engine/src/objective-anchor.ts's kindsFromPath (line 237) uses /package(?:-lock)?\.json$/u.test(filename) with no ^ anchor, so mock-package.json or sub-package.json gets tagged "dependency", while the adjacent config check for the identical two target filenames (three lines above) uses exact-match set membership via CONFIG_FILENAMES (lines 149-161). Same function, same two target names, two inconsistent match strategies.

Requirements

Anchor the regex (/^package(?:-lock)?\.json$/u) or switch this check to reuse CONFIG_FILENAMES exact-match membership, consistent with the adjacent config check in the same function.

Deliverables

• The dependency-file check no longer matches a differently-prefixed filename like mock-package.json
• A negative test asserting a file named e.g. sub-package.json does NOT produce a "dependency" change-kind, while package.json/package-lock.json still do

All of the above Deliverables are required in the same PR unless the deliverable text itself states otherwise.

Test Coverage Requirements

packages/loopover-engine/** -- 99%+ patch coverage, branch-counted, including the new negative test.

Expected Outcome

Only the exact filenames package.json/package-lock.json are classified as "dependency" change kind, matching the exact-match discipline already used for the adjacent config check in the same function.

Links & Resources

• packages/loopover-engine/src/objective-anchor.ts:149-161,237

[linear-code]

JSO-6153