setup-ts-deep-modules: package-only scan misses app deep imports

setup-ts-deep-modules promises that app code can import only a package's root entry points. Step 4 permits lint:boundaries to run depcruise <packages-root>, which does not include app importers outside that directory. A project can therefore pass the prescribed check while its app imports private package internals.

Observed on main d81f3a183412e71a5b1e84ca21bc1a35eea03a60, using the bundled dependency-cruiser.config.cjs unchanged, Node 24.14.1, dependency-cruiser 18.5.0, and TypeScript 6.0.3.

Minimal layout:

src/app.ts                           imports ./packages/example/lib/impl
src/packages/example/index.ts        exports answer from ./lib/impl
src/packages/example/lib/impl.ts     exports answer() returning 42
src/packages/example/tests/example.test.ts  imports ../index

With tsconfig.json present and the bundled config copied to .dependency-cruiser.cjs:

npx depcruise src/packages --config .dependency-cruiser.cjs --output-type err
  no dependency violations found
  exit 0

npx depcruise src --config .dependency-cruiser.cjs --output-type err
  error entrypoint-boundary-from-app: src/app.ts -> src/packages/example/lib/impl.ts
  exit 1

The existing completion proof only mutates the example's test import, so it can pass without showing that the app-import rule is actually reached.

Suggested change: scan the source roots containing both packages and their consumers, rather than allowing a package-only scan, and add an app-import mutation to the proof. depcruise src already works for the documented src/packages layout; projects with other source roots need their actual consumer roots included too.

This is a scan-scope issue, separate from the unsupported TypeScript 7 report in #974. The reproduction uses a supported TypeScript compiler and produces no transpiler warning.