fix(frameworks): detection reads an app's package.json three or more levels down (#2395)

declaredDependencies read the root manifest and the ones one or two
directories down. An app whose package.json sits deeper was never read:
an ASP.NET solution's src/Web/ClientApp/, or prometheus's
web/ui/mantine-ui/ under a workspace root that declares only tooling.
Every resolver gated on dependsOn() then stayed off for it: Angular Router
and the Angular template pass, React Router's navigation, Vue Router,
SvelteKit and TanStack Router.

The existing pass is unchanged. When it leaves slots open, a second pass
probes the directories three or more levels down that hold indexed JS/TS
code, shallowest first and sorted within a level, at most 192 of them,
never inside node_modules.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

docs/design/framework-coverage.md

@@ -231,6 +231,16 @@ Each of these cost real debugging time; they are not hypothetical.
    per file-count for exactly this reason — an earlier version cached the empty
    pre-index answer and every framework whose dependency lived one directory
    down stayed undetected.
+12. **An app's manifest can sit three or more levels down.** An ASP.NET
+   solution keeps its single-page app in `src/Web/ClientApp/`, and prometheus
+   keeps its React apps in `web/ui/mantine-ui/` under a workspace root at
+   `web/ui/` that declares only tooling. `declaredDependencies` reads the root
+   and the first two levels, then gives the slots left to the directories
+   above JS/TS code, shallowest first. Read only two levels deep, Angular
+   Router never ran on jasontaylordev/CleanArchitecture, and every
+   template-bound handler there was listed as dead code. A new detector that
+   gates on a dependency should ask `dependsOn`, not read a `package.json`
+   itself, so it sees the same manifests every other detector does.
 
 ---