Preserve Composer overlay source revisions

[chubes4]

Summary

• resolve the immutable Git revision of clean composer-package overlay sources before staging
• preserve that optional reference in prepared/runtime provenance and in both consumer and nested package Composer datasets
• keep duplicate Composer\InstalledVersions datasets aligned so runtime first-match ordering returns the reviewed source commit
• omit references for dirty, non-Git, unborn, or otherwise unresolved sources rather than fabricating provenance

Closes #1846.

Root cause

WP Codebox replaces a Composer package from a staged source checkout, but Composer metadata retained reference: null. Updating only the consumer metadata was insufficient because the nested package autoloader could register its own InstalledVersions dataset first. Composer then returned the nested dataset’s null reference even when the consumer dataset contained the correct commit.

This change writes the same resolved reference into both generic datasets, making runtime provenance deterministic regardless of loader order.

Compatibility impact

The recipe input schema is unchanged. Existing prepared/runtime output gains an optional additive reference field. Non-Git and unresolved sources retain existing behavior with no fabricated reference.

How to test

1. Run npm ci.
2. Run npm run test:composer-installed-versions-loader-order.
3. Run npm run test:composer-package-overlay-revision.
4. Run npm run test:recipe-runtime-setup-staged-materialization.
5. Run npm run test:recipe-run-provenance.
6. Run npm run test:runtime-command-result-envelope.
7. Run npm run build.
8. Run git diff --check origin/main...HEAD.

All commands pass locally.

End-to-end evidence

A supplementary one-fixture Static Site Importer matrix run was repeated before and after this change using unchanged SSI and Blocks Engine revisions. Before the change, evidence readiness failed solely because the transformer reference was missing. After the change:

• matrix evidence readiness was verified
• the transformer reference exactly matched the clean Blocks Engine source commit
• all 265 blocks remained valid and native, with zero core/html fallbacks
• visual metrics and source/candidate/diff screenshot hashes were identical
• the existing 36.13% visual mismatch remained correctly attributed to Blocks Engine, confirming this change affects provenance only

Known unrelated check

npm run test:schema-parity currently fails on main because docs/recipe-contract.md omits the existing inputs.services field. This PR does not change that schema or documentation surface.

AI assistance

• AI assistance: Yes
• Tool(s): OpenAI GPT-5.6 Sol with OpenCode
• Used for: We traced the provenance loss across recipe staging, Composer metadata, duplicate runtime datasets, and the downstream evidence consumer; implemented deterministic coverage; and verified the result with a fresh end-to-end capture.