workspace dependencies are lost in conversion, package-lock.json is invalid

Nobody has claimed this yet.

#### Issue description:
Using workspaces, `synp -w -s yarn.lock`will produce lockfile without dependencies of subprojects, see package `apps/app` below:
```json
{
"name": "app-bundle",
"lockfileVersion": 2,
"requires": true,
"packages": {
"": {
"name": "app-bundle",
"workspaces": [
"apps/*",
"packages/*"
],
"devDependencies": {
"@repo/eslint-config": "*",
"cross-var": "^1.1.0",
"dotenv-cli": "^7.4.2",
"eslint": "^8.57.0",
"prettier": "^3.2.5",
"prettier-plugin-svelte": "^3.2.2",
"turbo": "latest",
"vitepress": "^1.2.3"
}
},
"apps/app": {
"version": "0.0.1",
"dev": true
},
....
```

#### Are you reporting a conversion error? Please include a link to `yarn.lock` / `package-lock.json`:
https://gist.github.com/terion-name/f1f47479b83509f2fbde5619887fb6ad

Reproduce the issue with `synp -w -s yarn.lock` using the workspace example and compare the generated `package-lock.json` with the linked gist. Trace the workspace conversion path in synp and verify that dependencies from `apps/app` and other subprojects are retained and that the resulting lockfile is valid.

Written by the indexing model from the issue text.