Snapshot restore: pin URL/direct-ref-installed protected packages during repair pass instead of skipping them

Follow-up to #1248. The compatible-mode repair pass (`repairNodeRequirements`) protects the torch stack and related packages (`torch`, `torchvision`, `torchaudio`, `torchsde`, `nvidia-*`, etc.) by pinning them as constraints so the additive pip install cannot move them.

Limitation shipped in #1248: packages that were installed from a direct URL reference cannot be expressed as a `name==version` constraint (`name==URL` is invalid), so they are currently **skipped** from the constraint set rather than pinned. This leaves a small window where a repair install could upgrade/downgrade a URL-installed protected package.

Proposed fix: resolve installed versions via `uv pip list --format=json` (or equivalent) at repair time and pin the *observed version* (`name==`) even for URL-installed packages, falling back to skip only if the package is genuinely unlisted.

Start at repairNodeRequirements and inspect the compatible-mode constraint handling described in #1248. Use uv pip list --format=json at repair time to check the observed versions of URL-installed protected packages; done means those versions become name==version constraints, while genuinely unlisted packages remain skipped.

Written by the indexing model from the issue text.