Controller refresh cannot resolve authenticated transitive workspace modules

Summary

The release/v0.1.0 compatibility port for authenticated controller refresh walks every sealed transitive @ultrafuzz/* module, but resolves each module with import.meta.resolve(moduleName) from @ultrafuzz/runtime. A valid sealed module can be reachable through another controller module without being a direct Runtime dependency, so refresh fails with ERR_MODULE_NOT_FOUND before it can authenticate or publish a controller generation.

Minimal generic reproduction

1. Initialize a temporary generic external Solidity project and launch a small topology with a fake terminal workflow runner.
2. Read the verified workflow-control snapshot.
3. Add a valid sealed module record for an installed UltraFuzz workspace package that is not a direct dependency of @ultrafuzz/runtime.
4. Call refreshedSmithersControllerSnapshot.

Focused result on the release port:

not ok - controller refresh resolves sealed transitive modules from their authenticated package manifests
ERR_MODULE_NOT_FOUND: Cannot find package '@ultrafuzz/evals' imported from packages/runtime/dist-test/src/smithers.js
0 passed, 1 failed

The package exists and its authenticated sealed package.json record has the correct source path. Resolution fails only because it is attempted from Runtime's ambient dependency context.

Expected behavior

Controller refresh should anchor each sealed module to its authenticated package-manifest source path, then fail closed unless the real package root, manifest name/bytes, sealed path set, dependency authority, and executable authority still agree. It should not require every transitive controller module to be a direct dependency of @ultrafuzz/runtime.

Suggested regression checks

• A sealed transitive UltraFuzz module that is not linked from Runtime refreshes successfully from its authenticated manifest path.
• A missing or mismatched sealed package manifest is rejected.
• Package-name, dependency-authority, executable-authority, and removed-path drift remain rejected.
• No controller generation is prepared or committed when module validation fails.

Related to #721, but this is a concrete release-port resolution gap discovered after the refresh surface itself was added.

Start at packages/runtime/dist-test/src/smithers.js and reproduce the failure through refreshedSmithersControllerSnapshot using the generic external Solidity project setup. Review how the authenticated package-manifest source path is used during sealed module validation, then run the focused regression checks for transitive resolution, manifest mismatches, authority drift, removed paths, and failed generation commits. Done means valid transitive modules refresh while every listed mismatch remains rejected.