fix(index): preserve namespace package identity (0.0.46)

[Sunrisepeak]

Summary

• model package identity as canonical namespace:name while preserving the descriptor package.name as the short lookup token
• retain same-name packages from different namespaces and reject duplicate effective identities with deterministic descriptor-path diagnostics
• scope candidates, aliases, versions, search, and merge behavior to canonical identity without changing bare dependency inheritance semantics
• bump libxpkg to 0.0.46

Root cause

build_index() keyed entries only by package.name (or a repository prefix), so two descriptors with the same short name could overwrite one another based on filesystem scan order. The index also lacked explicit identity and short-name candidate tables needed by xlings to diagnose ambiguity.

Validation

• mcpp build
• mcpp test -- --gtest_filter=-ExecutorTest.ApplyElfpatchAuto_* (CI parity: 4 test binaries, 90 tests, 0 failures)
• verified red/green regression coverage for duplicate effective identity and legacy versioned merge keys
• git diff --check

Related to openxlings/xlings#381.