Composer dependency overlay can attest a mount without replacing runtime code

## Problem

A `composer-package` dependency overlay can report the requested Git reference and source digest as mounted while PHP still executes the consumer plugin's pre-existing package implementation.

This makes the overlay receipt look authoritative even though the runtime dependency was not replaced.

## Reproduction

1. Use a WordPress plugin that vendors an older Composer package revision.
2. Declare the plugin in `inputs.extra_plugins`.
3. Declare a clean newer package checkout in `inputs.dependency_overlays` with `kind: composer-package`.
4. Run a WP-CLI workload that exercises behavior which differs between the two package revisions.

Observed in a Static Site Importer fixture-matrix dependency-discovery recipe:

- The prepared mount records the newer package commit as `reference`.
- The mount records a content SHA-256 for the newer source.
- Direct host execution through the newer checkout succeeds.
- The same exact staged input inside WP Codebox fails with the diagnostic produced by the consumer's older vendored package.
- The mounted target is the expected consumer path: `vendor/automattic/blocks-engine-php-transformer`.

The mismatch remains after committing the source checkout and rerunning with a new artifact directory, so it is not dirty-worktree provenance or caller output reuse.

## Expected contract

1. A successful dependency-overlay mount makes the declared package implementation authoritative for Composer autoloading in the runtime.
2. The prepared overlay receipt proves the actual executable package tree, not only the requested mount input.
3. Integration coverage vendors revision A in a consumer, overlays behaviorally distinct revision B, and asserts PHP executes revision B through the consumer's normal autoloader.
4. If replacement cannot be guaranteed, recipe setup fails before workloads run.

## AI assistance

OpenAI GPT-5.6-Sol via OpenCode helped compare host and sandbox behavior, inspect mount attestations and Composer autoload paths, isolate the overlay boundary, and draft this report. Chris Huber remains responsible for the issue.

Start at the dependency-overlay setup and Composer autoloading boundary described in the issue, then inspect the Static Site Importer fixture-matrix dependency-discovery recipe. Reproduce the consumer with vendored revision A and overlay revision B, and trace the prepared mount receipt against the runtime package tree. Done means integration coverage proves the consumer autoloader executes revision B, or setup fails before workloads when replacement cannot be guaranteed.

Written by the indexing model from the issue text.