Generally you should not set applications, but instead extra_applications. Otherwise you need to list all of your applications, as well as all your dependencies applications, and your dependencies dependencies, etc.
No, direct dependencies are enough. No need to get transient dependencies into the list, as they all have their own :applications which will be considered when packaging and building the application start order.
I still don’t understand why this mattered here for dialyzer however. dialyzer seemed to be complaining that Mox couldn’t be found. Not that Mox wasn’t actually started. In fact does dialyzer even need to start apps to work correctly? I would have thought not.