fix(diff): detect upgrades for version-qualified purls

[dmchaledev]

Problem

diff() builds its component lookup map keyed on the raw purl:

const key = comp.purl ?? comp.name;

But a purl embeds the version (pkg:npm/lodash@4.17.21), and real-world SBOM generators (Syft, Trivy, cdxgen, …) almost always emit version-qualified purls. So the same package at two versions gets two different keys, and an upgrade is reported as a remove + add instead of an upgrade — defeating the tool's flagship "highlights upgraded dependencies" feature for the common case.

Reproduction (before)

old: lodash@4.17.20  →  new: lodash@4.17.21
added:    [ 'lodash@4.17.21' ]
removed:  [ 'lodash@4.17.20' ]
upgraded: []

The previous test even encoded this as "correct behavior", but it directly contradicts the README's promise.

Fix

Key components by a version-independent purl identity — strip the #subpath, ?qualifiers, and trailing @version, then fall back to the package name. (An npm scope like %40scope is percent-encoded, so a literal @ only ever separates the version.)

After

added:    []
removed:  []
upgraded: [ '4.17.20 -> 4.17.21' ]

Tests

• Replaced the test that asserted the buggy add/remove behavior with one asserting proper upgrade detection.
• Added coverage for purls carrying qualifiers/subpaths.
• Added a guard that distinct packages are not falsely reported as upgrades.

All 31 tests pass; lint and typecheck clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BPc7gpi66iTEvhzh9b3rNf

---

Generated by Claude Code