Preserve portable dependency overlay source references

[chubes4]

Summary

• add an optional validated immutable reference to Composer dependency overlays
• prefer the declared reference while retaining clean local Git inference as a fallback
• preserve declared references through dry-run/runtime provenance and Composer installed.json / installed.php metadata

Root cause

Lab run 50eadcfc-23c9-450a-929f-cb47f08f2a65 restored every matrix provenance field except transformer_reference. Direct runner probes against the exact materialized Blocks Engine source path proved it is not a Git repository:

• runner-exec-git-homeboy-lab-c96977e2-da47-482b-b201-84c7a8559e5d: git status failed with fatal: not a git repository
• runner-exec-git-homeboy-lab-3b27a7a2-2457-4c1f-b8a0-b849b55d10ad: git rev-parse --verify HEAD failed identically

Portable workspace sync intentionally excludes .git/, so runtime inference cannot recover orchestration-known source identity. The explicit recipe contract makes that identity portable without coupling WP Codebox to Homeboy.

Verification

• npm run test:composer-package-overlay-revision
• npm run build
• git diff --check

The executable regression proves a non-Git package source with an explicit reference reaches overlay metadata, runtime provenance, consumer installed.json, and PHP-visible installed.php.

Fixes #2058.

AI assistance

OpenCode using openai/gpt-5.6-sol investigated the Lab evidence, specified and reviewed the generic contract change, and completed deterministic verification and PR preparation. Homeboy using OpenCode with openai/gpt-5.6-terra drafted the implementation. Chris Huber reviewed and remains responsible for every line.

[chubes4]

End-to-end Lab verification passed with combined WP Codebox commit 0eebc856f63595c63c13ef19eb0863da2b3de13c (#2054 + #2057 + this PR) and SSI PR Automattic/static-site-importer#725.

Run 7dcbe7f4-865e-41c7-a994-4f80908051ee reports matrix_evidence_readiness.status: verified for 27-university-department, with missing: []. The portable dependency overlay preserved transformer reference 9ebb3a71790afd3068dedae79340088208e11c81 through Composer and the SSI import report despite the Lab source carrying no .git directory.

The fixture still fails its independent quality gates (preserved runtime islands and 73.17% visual mismatch); provenance verification is complete.