fix(update-deps): pick highest version when source workspace has duplicate package names

[pyramation]

Summary

update-deps builds a sourceMap from all package.json files in the source workspace, keyed by package name. When the same package name appears multiple times — for example pgsql-deparser in packages/deparser plus packages/deparser/versions/{13,14,15,16} — the last entry in the discovery order overwrote the map entry. That caused availableVersion to be a stale version (e.g. 13.19.1) even though the latest version (18.1.1) existed in the same workspace.

Now sourceMap selects the highest semver version per package name, so ^18.1.1 dependencies correctly resolve to 18.1.1 instead of a legacy version from a versioned subdirectory.

// before: last write wins
const sourceMap = new Map(sourcePackages.map(p => [p.name, p]));

// after: highest version wins
const sourceMap = new Map<string, WorkspacePackage>();
for (const pkg of sourcePackages) {
  const existing = sourceMap.get(pkg.name);
  if (!existing || compareSemver(pkg.version, existing.version) > 0) {
    sourceMap.set(pkg.name, pkg);
  }
}

Also added compareSemver and reused it inside isOutdated to keep version comparison in one place. A test now covers the duplicate-name case.

Link to Devin session: https://app.devin.ai/sessions/170bdcd5135649468b4bd7d1074f36be
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring