feat: coherence gate for shared library closures (#448)

[antoinetoussaint-byte]

Closes#448.

Summary

• Multi-SDK composition fails to link, not just look messy: when two
  independently generated library SDKs carry the same first-party
  contract at incompatible majors, a consumer that installs both panics
  (proto: file ... already registered in Go; duplicate descriptor-pool
  symbol in Python). This PR adds the composition-layer coherence check
  the issue asks for — the analog of Epic: durable versioned library publishing — storage abstraction for go get / pip / npm #446's immutability lock.
• New pkg/composition resolves a consumer's transitive
  library-dependency closure (over the existing LibraryDeps graph),
  records every constraint on each library, and rejects a version
  diamond — any shared library required at more than one major. The
  error names each side of the diamond so the consumer can pin one major.
• Wired into sync library-dependencies, which is where a service's
  closure is already resolved for local development — the diamond is now
  a clear configuration error instead of a runtime panic.

Scope / what is deferred

This delivers the coherence gate (issue's fix#3). The other two
fixes are already partly in place or blocked:

• Inter-library dependencies in library.codefly.yaml (fix #1) already
  exist in the model (resources.Library.LibraryDeps); this PR is the
  first consumer that resolves the closure coherently.
• Codegen "generate local, import deps" mode (fixbug: application tries to load services instances outside of application dependencies #2) needs a stable
  proto-module → published-library package-coordinate mapping, which
  is produced by the library store in Epic: durable versioned library publishing — storage abstraction for go get / pip / npm #446/feat(librarystore): versioned library store + GitHub Go strategy (#446) #447 (not yet merged). It is
  left for a follow-up on top of that store rather than stubbed here.

Test plan

• go test ./pkg/composition/... ./cmd/sync/...
• Unit tests (injected resolver): coherent shared library passes; a
  true cross-major diamond is reported with both sides named;
  unsatisfiable transitive dep errors; dependency cycle terminates.
• Integration test against a real on-disk workspace via the real
  LibraryResolver (coherent closure passes; unsatisfiable local
  constraint errors).
• go vet and gofmt clean on changed packages.