Promote source out of the constraint hash onto Declaration

[JPDuchesne]

Problem

Resolver#package_id builds a PackageId by excavating the constraint hash by key convention:

source = decl.constraint["repo"] || decl.constraint["url"]

Identity should be a field, not an excavation. A source-based package's coordinates (git URL, owner/repo slug) are part of which package this is — the same fact PackageId#source carries — yet on the declaration side they hide inside the constraint hash, whose job is to describe which versions qualify. Any new source-shaped key (a mirror URL, a monorepo path) silently extends the || chain.

Proposal

Give Declaration an explicit optional source field, stamped where the constraint is normalized (DSL verbs for project rows; repositories for transitive declarations). Resolver#package_id then reads decl.source and the key-convention dig dies. The constraint hash keeps only version-shaped keys (version, tag, buildid, …).

Notes

• Follow-up to PR Deps redesign: package universe repositories, Resolver-owned selection #142, which extracted Declaration as the shared atom (project rows and PackageVersion declared-deps alike) — the field now has exactly one home.
• Touches the lockfile only if we choose to serialize the declaration side someday; pins already carry their metadata.

[JPDuchesne]

Closed by #142: Declaration#source is now a first-class identity field — the DSL sorts repo/url/tap/app out of the constraint hash, Resolver#package_id reads decl.source directly, and source participates in Declaration equality and conflict rejection.