fix(project-detect): parse Python deps pinned with ~ and @ (was losing framework detection on compatible-release pins) (#2498)

* fix(project-detect): parse Python deps pinned with ~= and @ direct references

* test(project-detect): cover ~= compatible-release and @ direct-reference parsing

* test(project-detect): cover direct references

* fix(project-detect): skip bare VCS/URL requirement lines in getPythonDeps

A requirements.txt line like git+https://host/repo.git#egg=pkg carries
no leading package name, so the delimiter split recorded the whole URL
fragment as a dependency. Skip names that start with git+ or contain a
URL scheme, and tighten the test assertions so any leaked URL, scheme,
or @ delimiter fails loudly.

scripts/lib/project-detect.js

@@ -198,10 +198,13 @@ function getPythonDeps(projectDir) {
         const trimmed = line.trim();
         if (trimmed && !trimmed.startsWith('#') && !trimmed.startsWith('-')) {
           const name = trimmed
-            .split(/[>=<![;]/)[0]
+            .split(/[\s>=<!~@[;]/)[0]
             .trim()
             .toLowerCase();
-          if (name) deps.push(name);
+          // Bare VCS/URL requirement lines (e.g. `git+https://...#egg=pkg`)
+          // carry no leading package name; skip them instead of recording
+          // the URL fragment as a dependency name.
+          if (name && !name.startsWith('git+') && !name.includes('://')) deps.push(name);
         }
       });
     }
@@ -220,7 +223,7 @@ function getPythonDeps(projectDir) {
         block.match(/"([^"]+)"/g)?.forEach(m => {
           const name = m
             .replace(/"/g, '')
-            .split(/[>=<![;]/)[0]
+            .split(/[\s>=<!~@[;]/)[0]
             .trim()
             .toLowerCase();
           if (name) deps.push(name);