Builder for candidates still needs work

These lines screw things up:

https://github.com/haskell/hackage-server/blob/4d6d2089d442859e3d04874a82f421cb8950eef5/exes/BuildClient.hs#L496

https://github.com/haskell/hackage-server/blob/4d6d2089d442859e3d04874a82f421cb8950eef5/exes/BuildClient.hs#L499

This looks up the package in the repoIndex. But for a candidate that _isn't_ a dup (i.e. for which that name/version pair is not yet in the main index) then of course the package won't be in the repoIndex yet!

So we need a different code path for candidates that entirely bypasses these lookups and handles candidates specially/directly.