Generate explicit install source metadata for PyPI and Git installs

Parent epic: #15

Depends on: #16, #17, #21

Why

The default NVIDIA tap can use PyPI source metadata, but the ecosystem design also calls out direct Git subdirectory installs and local editable authoring loops. The schema from #16 defines pypi, git, and path; this issue implements concrete generation and validation for all three source types.

Source generation rules

Use [tool.ddp.tap].default-source as the default source type for all packages unless a package-level override is added later. Implement these exact generation rules:

pypi

{"type": "pypi", "package": "data-designer-example"}

• package is [project].name.
• DataDesigner default exact install target is data-designer-example==<package.version>.

git

{
  "type": "git",
  "url": "https://github.com/NVIDIA-NeMo/DataDesignerPlugins.git",
  "ref": "data-designer-example/v0.1.0",
  "subdirectory": "plugins/data-designer-example"
}

• url is [tool.ddp.tap].repository-git-url.
• ref is [tool.ddp.tap].release-ref-template.format(package=package.name, version=package.version).
• subdirectory is package.path.
• DataDesigner default install target is <package.name> @ git+<url>@<ref>#subdirectory=<subdirectory>.

path

{"type": "path", "path": "plugins/data-designer-example", "editable": true}

• path is package.path by default.
• editable defaults to true.
• path sources are allowed only for local file/path taps and test fixtures; the default NVIDIA raw catalog must not use them.

Implementation

• Add a source generation function that takes package metadata, repo-relative package path, and tap config and returns one validated source object.
• Add source validation for all three source types.
• Add tests for each source type.
• Add a test proving multi-plugin packages share the same generated source object for each package entry.
• Keep source metadata generated; do not require maintainers to hand-edit catalog/plugins.json.

Acceptance criteria

• pypi, git, and path source objects are generated and validated exactly as specified above.
• Invalid default-source, missing repository-git-url for git, missing release-ref-template for git, or malformed package paths fail with useful errors.
• The checked-in NVIDIA catalog uses pypi sources only unless the repo config is explicitly changed.
• Tests cover exact DataDesigner install-target derivation for each source type.
• Multi-plugin packages share one source identity across all runtime plugin entries from the same package.

Dependencies

• Depends on: #16, #17, #21.
• Blocks: #20, #23, #25, and DataDesigner CLI install planning.

Start with the schema from #16 and the existing tap/catalog generation and validation entry points; trace how package metadata and repo-relative paths are represented. Add coverage for pypi, git, and path sources, including install targets and shared multi-plugin source identity, then verify catalog/plugins.json uses pypi sources and invalid configurations produce useful errors.