fix: handle virtual providers in forbid registration

[baszalmstra]

Version sets can represent virtual capabilities, so their candidates do not necessarily share one concrete package name. The optimization in #288 assumed they did. Debug builds trip the assertion, while release builds can put unrelated packages in the same at-most-one bucket and turn a valid solve into UNSAT.

This keeps the bulk registration path when all candidates have the same concrete name. Mixed-name candidate lists fall back to registering each candidate under its own name.

The regression test models a virtual capability provided by two packages and requires both concrete packages. It fails at the assertion in debug builds and returns UNSAT in release builds before the fix.

Testing

• cargo fmt --check
• cargo test --all-features
• cargo test --release test_virtual_package_candidates_can_have_different_names