feat(source-files): wire archive overlays into prep-sources with post-overlay hash tracking

[Tonisal-byte]

Wires archive-scoped overlays into the source preparation pipeline.

This applies archive overlays during prep-sources, repacks modified archives, refreshes their sources file hashes, and adds origin.type = "overlay" for recording expected post-overlay archive hashes. It also ensures overlay-origin source files are not downloaded separately and validates stale configured hashes during full source prep.

Example:

# Declares the expected post-overlay archive hash. This must have the same
# filename as the archive targeted below and replaces its upstream `sources`
# entry during render.
[[components.example.source-files]]
filename = "example-1.0.tar.gz"
hash = "..."
hash-type = "SHA2512"
origin = { type = "overlay" }
replace-upstream = true
replace-reason = "Remove bundled vendor files not shipped by Azure Linux"

# Multiple archive overlays can use the same overlay-origin entry.
[[components.example.overlays]]
type = "file-remove"
archive = "example-1.0.tar.gz"
file = "vendor/**"
description = "Remove bundled dependencies"

[Copilot]

Pull request overview

This PR wires archive-scoped overlays into the prep-sources pipeline: archives modified by overlays are deterministically repacked, their corresponding sources entries are re-hashed, and configuration can record/validate expected post-overlay hashes via a new origin.type = "overlay" source-file origin.

Changes:

• Add new OriginTypeOverlay / schema enum value "overlay" and associated config validation rules for overlay-origin source-files entries.
• Apply archive overlays during prep-sources, repack modified archives, and rehash only the affected sources entries; additionally validate configured post-overlay hashes during full prep.
• Adjust Fedora lookaside extraction to avoid skipping files that are not actually fetched by FetchFiles (e.g., overlay-origin entries).

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
schemas/azldev.schema.json	Adds "overlay" to the origin.type enum in the JSON schema.
scenario/snapshots/TestSnapshotsContainer_config_generate-schema_stdout_1.snap	Updates schema snapshot output for the new enum value.
scenario/snapshots/TestSnapshots_config_generate-schema_stdout_1.snap	Updates schema snapshot output for the new enum value.
internal/providers/sourceproviders/sourcemanager.go	Skips downloads for overlay-origin refs; refactors provider attempts into helper; adds internal guard for overlay origin in download path.
internal/providers/sourceproviders/fedorasourceprovider.go	Avoids skipping upstream lookaside downloads for non-fetched origin types (e.g., overlay).
internal/projectconfig/fingerprint_test.go	Improves fingerprint tag parsing/validation to account for hashstructure tag options.
internal/projectconfig/configfile.go	Adds overlay-origin validation rules and calls archive-overlay/origin validation during config validation.
internal/projectconfig/configfile_test.go	Adds validation coverage for archive overlay requiring an overlay-origin entry.
internal/projectconfig/component.go	Introduces OriginTypeOverlay, OriginType.IsFetched, and ValidateArchiveOverlayOrigins.
internal/app/azldev/core/sources/sourceprep.go	Applies archive overlays first, tracks repacked archives, rehashes corresponding sources entries, and validates configured post-overlay hashes.
internal/app/azldev/core/sources/sourceprep_test.go	Adds end-to-end tests around archive overlay repacking + sources rehashing behavior.
internal/app/azldev/core/sources/archiveoverlays.go	Implements batching of archive overlays per archive (single extract/modify/repack cycle per archive).
internal/app/azldev/core/sources/archiveoverlays_test.go	Adds coverage for archive overlay glob semantics and end-to-end behavior via PrepareSources.
internal/app/azldev/core/sources/archiveoverlays_internal_test.go	Adds direct unit coverage for archive overlay grouping behavior.
internal/app/azldev/core/components/resolver.go	Validates archive overlay/origin invariants after config resolution/overlay-file expansion.
docs/user/reference/config/overlays.md	Documents drift-protection requirement for archive overlays via overlay-origin source-files.
docs/user/reference/config/components.md	Documents the new "overlay" origin type and the workflow for recording post-overlay hashes.

[Copilot]

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 3 comments.

[dmcilvaney]

Should have a matrix of tests (and maybe a full e2e scenario test?)

• overlay-origin without archive overlay fails
• archive overlay without origin fails
• matching custom/download origin for an archive fails
• overlay-origin w/ configured result matches
• stale hash fails
• algorithms are stable (ie SHA512 -> SHA512, not SHA512 -> SHA256)
• local lookaside and fedora paths both keep the original archive when overlay-origin ref is used
• --skip-sources still ensures hashes are valid

[dmcilvaney]

Render always sets skipLookaside, my feeling is we either need to track the hashes of every input (including scripts etc.), or re-run this during render. The issue is sources is created by render, and afaik that is the definitive truth used by koji to get source files. We need a way to ensure that a PR has the correct values for the sources file.