Support multiple cached versions of the same package

Summary

Fixes #48

• Support multiple cached versions of the same package in sources.json instead of collapsing entries to name + registry
• Make opensrc path use exact version-aware cache lookup while preserving current bare-spec resolution behavior
• Make opensrc remove zod@x.y.z remove only that exact cached version
• Keep opensrc remove zod behavior as “remove all cached versions of that package”
• Sort opensrc list output by package name and version for easier multi-version inspection
• Preserve shared versioned checkouts until the last package or repo reference is gone

Example

opensrc path zod@3.25.76
opensrc path zod@4.3.6
opensrc list
opensrc remove zod@3.25.76
opensrc list

With this change, both versions can coexist cleanly in the cache and index, and removing one version does not remove the other.

Notes

• This does not add migration-specific semantics (from / to)
• This does not change bare monorepo-root ambiguity for commands like opensrc path zod
• It only makes multi-version caching/indexing/listing/removal behave correctly once exact versions are resolved

Testing

cargo test --manifest-path packages/opensrc/cli/Cargo.toml -- --test-threads=1
cargo fmt --manifest-path packages/opensrc/cli/Cargo.toml
cargo clippy --manifest-path packages/opensrc/cli/Cargo.toml -- -D warnings

Added coverage for:

• preserving multiple versions in the index
• replacing only the same exact version entry
• exact-version lookup
• exact-version removal
• all-version removal
• preserving shared monorepo version directories
• preserving version directories still referenced by repo cache entries
• deleting shared version directories only after the last reference is gone