packages that have non-cran dependencies fail to lock/install

[B-Nilson]

Trying to install B-Nilson/airquality using uvr in a new project fails because B-Nilson/airquality depends on B-Nilson/handyr, and uvr appears to only check CRAN for sub-dependencies - failing on this github remote package

[project]
name = "test_project"
r_version = ">=4.1.0"

[dependencies.airquality]
git = "B-Nilson/airquality"

> uvr::lock()
 x ERROR  Dependency resolution failed
  Package not found: handyr. If this package was recently archived from CRAN, try installing from the CRAN GitHub mirror: uvr add cran/handyr@master

[nbafrank]

@B-Nilson — fixed on `main` (commit b4223af). The resolver was only walking the manifest's direct github deps; transitive `Remotes:` entries (`airquality` → `B-Nilson/handyr`) fell through to CRAN and bailed.

`resolve_github_deps` now BFS-walks the `Remotes:` chain: each package's DESCRIPTION is parsed via the shared `parse_remotes_field` from manifest.rs, github-prefixed entries get queued, and dedupe is on `"user/repo[@ref]"`. Manifest-direct specs hard-error on github fetch failure; transitive specs warn and fall back to the registry chain (so a typo in a third-party DESCRIPTION doesn't brick your lock). Pre-resolved packages also now validate the parent's `Imports:` constraint — was being silently bypassed before, which would have allowed a too-old github `handyr` to load against `Imports: handyr (>= 1.0.0)`.

End-to-end verified against your reproducer:

```toml
[dependencies.airquality]
git = "B-Nilson/airquality"
```

```
$ uvr lock
✓ Lockfile updated — 75 package(s)
resolved in 808ms
```

Both `airquality` and `handyr` end up with `source = "github"` and pinned commit SHAs in the lockfile.

Will ship in v0.3.5 once the Windows binary issue (#74) is sorted. If you want to test against `main` before then: `cargo install --git https://github.com/nbafrank/uvr --branch main --force` (Mac/Linux only — Windows builds via cargo locally per your earlier comment).

[nbafrank]

@B-Nilson let me know if this works!