fix(core): regressions in graph verify for public/private & local

[paularmstrong]

Problem:

1. Public packages were able to list private packages as production dependencies.
2. Local workspace dependencies were skipped on actual version verification – only the integrity of the same version across the dependency graph was being verified, but not the actual declared version.

Solution:

Added checks & regression tests

Related issues:

Fixes #678, #682

Checklist:

• Added or updated tests
• Added or updated documentation
• Ensured the pre-commit hooks ran successfully

[paularmstrong]

cc @alecmev

[netlify]

✅ Deploy Preview for onerepo canceled.

Name	Link
🔨 Latest commit	2b7579f
🔍 Latest deploy log	https://app.netlify.com/sites/onerepo/deploys/66083e4059cb79000819bd7d

[alecmev]

Looks great, thank you! I think I'll be able to delete constraints.pro with this 😛

[paularmstrong]

FYI: I'll try to cut a release tomorrow