enhancement(assembly): promote cargo-auditable Rust binaries to own their dependency graph

[mstykow]

Context

DatasourceId::RustBinary is classified UnassembledReason::BinaryArtifact. The compiled_binary detector extracts a cargo-auditable dependency graph and the binary itself has a purl, but the binary is not promoted to a top-level package, so its transitive deps are hoisted/flattened without an owner. Parser/detector exists (#107, closed).

Proposal

Optionally promote a cargo-auditable Rust binary to its own top-level package (e.g. an OnePerPackageData-style path for the binary detector) so the embedded dependency graph is owned by the binary's package. Lower priority — binary attribution is a modeling choice, not a parity gap.

Acceptance

• A cargo-auditable binary yields a top-level package owning its dependency graph.
• Contract test.