address Copilot review: normalize SBOM names, reject wheel '..' segments, Windows-safe cache/wheel rename, fix lock-not-found message

- sbom: normalize component names (PEP 503) for canonical pkg:pypi PURLs and stable ordering
- wheel: reject any member with a '..' path segment (catches escapes that resolve back under the prefix but out of site-packages)
- cache/wheelhouse: replace file atomically across platforms (os.Rename fails on existing dest on Windows)
- project: include requirements.lock in the no-lock-found error
- tests for each

Co-authored-by: Jason Hall <imjasonh@users.noreply.github.com>

pymage/internal/cache/cache_test.go

@@ -20,6 +20,14 @@ func TestTextRoundTrip(t *testing.T) {
 	if v, ok := c.GetText("k"); !ok || v != "3.14" {
 		t.Fatalf("GetText = %q,%v; want 3.14,true", v, ok)
 	}
+	// Overwriting an existing key must succeed on all platforms (os.Rename onto
+	// an existing dest fails on Windows; replaceFile handles it).
+	if err := c.PutText("k", "3.15"); err != nil {
+		t.Fatalf("overwrite PutText: %v", err)
+	}
+	if v, ok := c.GetText("k"); !ok || v != "3.15" {
+		t.Fatalf("GetText after overwrite = %q,%v; want 3.15,true", v, ok)
+	}
 }
 
 func TestPutGetRoundTrip(t *testing.T) {