fix: carry candidate overlays into dependency discovery

[chubes4]

Summary

• normalize the candidate transformer overlay once and apply it to dependency discovery and the final import recipe
• retain exact package path and immutable reference in both effective recipes
• derive candidate lineage from the final recipe declared overlays, preventing claims for absent candidates

Fixes #872.

Refs #870 and #819.

Tests

• npm run test:fixture-matrix
• npm test (54 selected checks passed, including 44 standalone PHP checks)

AI assistance

OpenAI gpt-5.6-sol via OpenCode implemented the overlay propagation, provenance guard, and contract coverage. Chris remains responsible for every line.

[chubes4]

Disclosure correction: the commit message names GPT-5.6 Terra, but the actual model used for this work was OpenAI gpt-5.6-sol via OpenCode. The PR body now contains the accurate disclosure. Chris Huber remains responsible for every line.

AI assistance: OpenAI gpt-5.6-sol via OpenCode identified and corrected the disclosure mismatch.