nexum-world: enforce a shared-root invariant in resolve_wit_packages

[mfw78]

Follow-up from review of nullislabs/shepherd#440 (comment). Confirmed still valid at the end of the completed shepherd feature train. Code is in nexum-world (L1 nullislabs/nexum-runtime).

Problem

resolve_wit_packages resolves each requested package independently, walking its own ancestor chain, with no shared-root invariant. The prior resolve_wit_packages located one wit/ root (the one containing nexum-host) and resolved every package under that same root.

Failure scenario: a crate that vendors wit/deps/pkg-a locally but not pkg-b silently pulls pkg-a from crate-local and pkg-b from a differently-versioned copy in some unrelated ancestor wit/, with no error and no signal the resolved set is incoherent. The synthesize call sites always request multiple packages at once (for example ["nexum-host", "videre-value-flow", ...]), and no test covers a multi-package case split across ancestor levels (every resolve_wit_packages test passes a single-element list).

At HEAD the split-repo layout co-locates each repo's packages under one wit/ root, so it does not trigger today, but the guard is absent.

Change

• Track the ancestor level each package resolves at and error if they disagree.
• Add a test with two or more packages that resolve from different ancestor levels.