Fix path→base migration gaps in dependency resolution and validation

[hyericlee]

Summary

Fixed three bugs where code was reading dep.path after the parsePackageYml migration had already moved it to dep.base for local source dependencies.

Changes

1. dependency-graph.ts (Bug #1 - HIGH priority)

• Updated shadow PackageDependency interface to include base field
• Modified resolveFromManifest() to check dep.base || dep.path (modern field first, legacy fallback)
• Fixes the failing test: tests/core/source-resolution/source-resolution.test.ts where transitive dependencies with local paths were falling through to registry lookup

2. dependency-containment.ts (Bug #2 - MEDIUM priority)

• Updated validation to include dep.base in containment checks
• Previously only checked dep.path, so dependencies migrated to dep.base were silently skipped
• This was a publish-time safety gap where a package with an escaping base path could have been published

3. package-management.ts (Bug #3 - LOW priority)

• Changed GitHub name matching from dep.path to dep.base when extracting git source paths
• For git sources, base is the subdirectory within the repo (post-migration); path is for resource selection
• Fallback to deprecated subdirectory field for backward compatibility

Test Results

• ✅ tests/core/source-resolution/source-resolution.test.ts now passes
• ✅ Build succeeds
• ℹ️ Pre-existing failures in tests/core/add/add-flow-based-mapping.test.ts are unrelated

Migration Context

The parsePackageYml function performs semantic field migration for local source dependencies:

• Renames dep.path → dep.base (separates source navigation from resource selection)
• Deletes the old path field, so downstream code must read from base

These fixes ensure all three resolution/validation paths handle the migrated field correctly.