Bomly smoke-test fixture: an npm workspace with a root dependency (ms),
two members (apps/web, packages/lib) that share a pinned vulnerable
transitive dependency (minimist@1.2.5, lodash@4.17.20), a workspace
link dependency (web -> lib), and a member devDependency (left-pad).
Pinned by tag for deterministic goldens — do not update dependencies.