Add transitive dependency resolution and lock file support

Implements two major features for project dependency management:

Transitive Dependency Resolution:
- DependencyGraph/DependencyNode for structured dependency tracking
- DependencyGraphBuilder with recursive resolution and cycle detection
- Topological sorting for correct install order (dependencies first)
- Version conflict detection with provenance tracking
- Full semver support: ^, ~, >=, <=, >, <, = constraints
- New `cmdforge deps tree` command to visualize dependency tree
- Install flags: --dry-run, --force, --verbose

Lock File Support (cmdforge.lock):
- Lockfile/LockedPackage/LockfileMetadata dataclasses
- Records exact versions of all dependencies (direct + transitive)
- Integrity verification via SHA256 hashes
- `cmdforge lock` to generate/update lock file
- `cmdforge verify` to check installed tools match lock
- Install flags: --frozen, --strict-frozen, --ignore-lock

62 new tests for version, dependency_graph, and lockfile modules.

Co-Authored-By: Claude Opus 4.5 <[email protected]>

README.md

@@ -441,13 +441,53 @@ cmdforge init
 cmdforge add official/summarize
 cmdforge add myuser/tool@^2.0.0    # With version constraint
 
-# Install all dependencies
+# Install all dependencies (including transitive)
 cmdforge install
 
 # Check dependency status
 cmdforge deps
+
+# Show full dependency tree
+cmdforge deps tree
 ```
 
+### Reproducible Installs with Lock Files
+
+Lock files ensure identical tool versions across machines and over time:
+
+```bash
+# Generate lock file after installing
+cmdforge lock
+
+# Install exact versions from lock (reproducible)
+cmdforge install                    # Uses lock file if present
+
+# CI/CD: Fail if lock is missing or stale
+cmdforge install --frozen           # Requires lock file
+cmdforge install --strict-frozen    # Requires lock + manifest match
+
+# Verify installed tools match lock
+cmdforge verify
+
+# Preview what would be installed
+cmdforge install --dry-run
+
+# Ignore lock and resolve fresh
+cmdforge install --ignore-lock
+```
+
+### Version Constraints
+
+CmdForge supports semantic versioning constraints:
+
+| Constraint | Meaning | Example |
+|------------|---------|---------|
+| `*` | Any version | `official/summarize` |
+| `^1.2.3` | Compatible (>=1.2.3 <2.0.0) | `tool@^1.2.3` |
+| `~1.2.3` | Approximately (>=1.2.3 <1.3.0) | `tool@~1.2.3` |
+| `>=1.0.0` | Greater or equal | `tool@>=1.0.0` |
+| `1.0.0` | Exact version | `[email protected]` |
+
 This ensures all required tools are available before running your project's scripts.
 
 ## Collections