docs: document _getDependencyData() directory parameter semantics

[ruromero]

Summary

• Add a "Provider Implementation" section to CONVENTIONS.md documenting the _getDependencyData() directory parameter semantics
• Explains that _createSbom passes both manifestDir (project directory) and workspaceDir (lock file directory) to _getDependencyData
• Provides guidance for new provider implementations on which directory parameter to use

Implements TC-4102

[ruromero]

Verification Report for TC-4102 (commit 9c2a34f)

Check	Result	Details
Review Feedback	N/A	No reviews or comments on the PR
Root-Cause Investigation	N/A	No sub-tasks to investigate
Scope Containment	WARN	Task specifies CONVENTIONS.md but PR modifies src/providers/base_pyproject.js — intentional scope change directed by author to co-locate docs with code
Diff Size	PASS	11 additions, 0 deletions, 1 file — proportionate for a documentation task
Commit Traceability	PASS	Commit references Implements TC-4102
Sensitive Patterns	PASS	No matches
CI Status	PASS	All 4 checks pass (lint Node 22, lint Node 24, PR title, commit messages)
Acceptance Criteria	PASS	2 of 2 criteria met (documentation placed in JSDoc per author direction)
Test Quality	N/A	No test files in the PR
Verification Commands	N/A	No verification commands in task

Overall: WARN

Scope deviation is intentional — the author redirected documentation from CONVENTIONS.md to a JSDoc comment on Base_pyproject._getDependencyData() in src/providers/base_pyproject.js for maintainability. Both acceptance criteria are satisfied in the new location.

---

This comment was AI-generated by sdlc-workflow/verify-pr v0.5.11.