feat(sources): warn when sources disagree on a version or a slug

[ncrmro]

Adds OFTR-004.7 (Ambiguous Source Resolution) with pinned tests and detection in the resolver, per the requirements-governance discipline: canon, tests, and implementation in one change set.

The defect class

Two production incidents this month, one class — ambiguity resolved by silent selection:

1. Two catalogs both shipped agent slug actions-agent; source order silently picked the wrong one.
2. ai-outfitter/wiki's project settings declared community-profiles v1.2.0, which replaced the CI-written settings naming the org catalog wholesale — the org catalog was silently dropped and a run resolved a deleted model (fixed configuration-side in ai-outfitter/wiki#8).

Both times outfitter list agents printed the wrong resolution and exited 0.

What resolution now warns on

• The same source repository declared at two different refs across all declared configuration, naming each declaring scope and the winner.
• The same agent or skill slug supplied by more than one source, naming each source and the winner (intentional overrides included — visibility, not prohibition).
• A settings scope's sources list replacing a lower scope's list and dropping a declared repository entirely, naming the dropped source, its declaring scope, and the replacing scope. This is the wiki incident's actual shape.

Warnings surface through every resolving command (sync, validate, list agents, run). Precedence is unchanged — detection never alters which declaration wins.

First adversarial review REFUTED the initial implementation: it detected same-repo ref conflicts but stayed silent on the wiki incident, because detection ran after mergeSettingsStack had discarded the replaced source list. The third bullet and its pinned regression test (the exact incident shape) came out of that review; the fix was verified empirically against the built CLI.

A follow-up PR makes --strict fail on ambiguous resolution instead of warning (the negative half of the "one pin per source" milestone demo).

🤖 Generated with Claude Code