fix: code scanning alert 8 in dependency detection

[jbeckwith-oai]

Summary

• replace regex-based import parsing with a small line-oriented import reader
• preserve existing dependency detection behavior for package imports
• add a regression test through writeProviderFile package generation

Root Cause

CodeQL flagged the provider dependency regex as polynomial-time on crafted import strings. The parser only needs a single import specifier per line, so a direct string scan is simpler and safer.

Validation

• npm test -- src/generator/config-imports.test.ts
• npm run build