Add transitive dependency resolution and lock file support

Implements two major features for project dependency management:

Transitive Dependency Resolution:
- DependencyGraph/DependencyNode for structured dependency tracking
- DependencyGraphBuilder with recursive resolution and cycle detection
- Topological sorting for correct install order (dependencies first)
- Version conflict detection with provenance tracking
- Full semver support: ^, ~, >=, <=, >, <, = constraints
- New `cmdforge deps tree` command to visualize dependency tree
- Install flags: --dry-run, --force, --verbose

Lock File Support (cmdforge.lock):
- Lockfile/LockedPackage/LockfileMetadata dataclasses
- Records exact versions of all dependencies (direct + transitive)
- Integrity verification via SHA256 hashes
- `cmdforge lock` to generate/update lock file
- `cmdforge verify` to check installed tools match lock
- Install flags: --frozen, --strict-frozen, --ignore-lock

62 new tests for version, dependency_graph, and lockfile modules.

Co-Authored-By: Claude Opus 4.5 <[email protected]>

CHANGELOG.md

@@ -6,6 +6,49 @@ All notable changes to CmdForge will be documented in this file.
 
 ### Added
 
+#### Transitive Dependency Resolution
+- **Full transitive dependency resolution**: When installing dependencies, CmdForge now resolves and installs the complete dependency tree
+  - `DependencyGraph` and `DependencyNode` dataclasses for structured dependency tracking
+  - `DependencyGraphBuilder` class for recursive resolution with cycle detection
+  - Topological sorting ensures dependencies are installed before dependents (Kahn's algorithm)
+  - Version conflict detection with provenance tracking (which package requested each version)
+  - Registry config caching during resolution to avoid duplicate fetches
+
+- **Semver version constraint matching**: Full semantic versioning support
+  - Caret constraints: `^1.2.3` (>=1.2.3 <2.0.0), `^0.2.3` (>=0.2.3 <0.3.0), `^0.0.3` (exact match)
+  - Tilde constraints: `~1.2.3` (>=1.2.3 <1.3.0)
+  - Comparison operators: `>=`, `<=`, `>`, `<`, `=`
+  - Wildcards: `*`, `latest`
+  - Prerelease version handling per semver spec
+
+- **New CLI commands**:
+  - `cmdforge deps tree` - Show full dependency tree with transitive dependencies
+  - `cmdforge deps tree --verbose` - Show detailed resolution info
+
+- **Enhanced install command**:
+  - `--dry-run` - Show what would be installed without installing
+  - `--force` - Install despite version conflicts (first constraint wins)
+  - `--verbose` - Show detailed resolution info
+
+#### Lock File Support
+- **Lock file for reproducible installs**: `cmdforge.lock` records exact versions of all dependencies
+  - `Lockfile`, `LockedPackage`, `LockfileMetadata` dataclasses
+  - Records direct and transitive dependencies with provenance (`required_by`)
+  - Integrity verification via SHA256 hashes (uses registry `config_hash`)
+  - Normalized YAML hashing via `hash_utils.compute_yaml_hash()` for consistent integrity checks
+  - Platform and Python version metadata for debugging
+
+- **New CLI commands**:
+  - `cmdforge lock` - Generate or update `cmdforge.lock`
+  - `cmdforge lock --force` - Force regenerate even if up to date
+  - `cmdforge verify` - Verify installed tools match lock file
+
+- **Lock-aware install**:
+  - `cmdforge install` - Uses lock file when present for reproducible installs
+  - `--frozen` - Fail if lock file is missing (for CI)
+  - `--strict-frozen` - Fail if lock file is stale (manifest changed)
+  - `--ignore-lock` - Ignore lock file and resolve fresh from manifest
+
 #### Local Collections Support
 - **Local collection definitions**: Create and manage collections locally before publishing
   - Collections stored as YAML files in `~/.cmdforge/collections/`