fix(oa009): declaration guard resolves against the root manifest, diverging from PD001

Note: this is an in-house item already being handled by the maintainer - not open for contribution. Filed for tracking only.

Surfaced while reviewing #1114, which resolves PD001/PD002 declarations against the nearest enclosing workspace member. OA009's safety guard was not updated to match, so after that lands the two rules disagree.

The guard

src/overrides/detectors/oa009-stale-floor.ts:59-62

if (ctx.importedPackageNames.has(entry.packageName)) {
  const declared = getDeclaredPackages(ctx.packageJson);   // root manifest only
  if (!declared.has(entry.packageName)) continue;
}

The guard exists so OA009 stays quiet when removing an override would create a phantom import that PD001 would then report. Once PD001 resolves per workspace member, a package declared in apps/web/package.json but not at the root makes PD001 correctly fall silent while OA009 still suppresses itself. The result is a genuinely redundant override floor that no rule reports.

Fix: call the shared undeclaredImportFiles from phantom-utils so both rules answer the declaration question the same way.

Second, smaller problem in the same lines

OA009 carries its own private getDeclaredPackages (oa009-stale-floor.ts:13) reading only dependencies and devDependencies, while phantom-utils.getDeclaredPackages reads four sections including peerDependencies and optionalDependencies. Two functions, same name, different semantics. A package declared only as a peer dependency is invisible to OA009's guard.

Pre-existing, but worth fixing in the same pass.

Severity

OA009 is low, and the failure is a missed finding rather than a false one, so this is not urgent. It should land soon after #1114 so the two rules do not stay out of step, and website/docs/override-hygiene/pd001.md still states that PD001 and OA009 pair up.

Start in src/overrides/detectors/oa009-stale-floor.ts:13 and lines 59-62, then compare its declaration guard with the shared phantom-utils helpers used by PD001. Update the guard to use undeclaredImportFiles and the shared declaration semantics, including peerDependencies and optionalDependencies. Done means OA009 and PD001 resolve declarations consistently for workspace members without suppressing redundant override floors.