[BUG] incompatible immutable dependency refs are silently collapsed

Describe the bug

APM silently collapses incompatible immutable dependency refs for the same package identity.

A consumer declares both:

• a direct dependency on shared-package#v1, and
• parent-package#v1, which transitively requires shared-package#v2.

Both refs are immutable. APM installs and locks only shared-package#v1, emits no conflict warning or error, and accepts the resulting graph in frozen mode. The installed parent therefore receives a different immutable version than its manifest requires.

To Reproduce

1. Create shared-package tags v1 and v2.
2. Create parent-package#v1 with a dependency on shared-package#v2.
3. Create a consumer with direct dependencies on shared-package#v1 and parent-package#v1.
4. Run a normal install.
5. Inspect the lockfile and installed packages: only shared-package#v1 is present.
6. Run the equivalent frozen install. It succeeds without reporting the incompatible transitive requirement.

Expected behavior

Different immutable refs for one package identity should either:

1. fail resolution with a clear conflict listing the parents and requested refs, or
2. install isolated versions when the deployment model supports that safely.

Frozen replay should not accept a graph in which an immutable transitive requirement was replaced by a different ref.

Environment (please complete the following information):

• OS: macOS
• Python Version: 3.14.7
• APM Version: 0.31.0 installed with Homebrew
• VSCode Version (if relevant): Not applicable

Logs

No warning or error is emitted. The lockfile contains only the directly pinned immutable ref.

Reproduce the dependency graph with shared-package#v1, shared-package#v2, and parent-package#v1, then inspect the lockfile and frozen-install path. Trace how immutable refs are resolved and collapsed for one package identity. Done means the incompatible transitive ref is rejected with a clear conflict or safely isolated, and frozen replay cannot accept the substituted graph.