Resolve external import roots and repair imports during tidy

[Yakwilik]

Metadata-free Git dependencies previously assumed repository-root imports, so legacy git_repo.root/sub_directory inputs could not migrate reproducibly. Resolve import roots from the dependency's own import bindings or checked hints, record fallback roots in protobuf.lock, and replay them on cold caches and frozen operations. Native, Buf and legacy root metadata retain priority.

When an explicitly changed requirement adopts a different import namespace, mod tidy rewrites uniquely verified consumer import declarations, compiles the proposed source, and commits source, manifest and lock together. For example, an old import svc.proto becomes service/v1/svc.proto when the same verified dependency contract gains authoritative roots api. Tidy does not upgrade declared versions; get/update report implicit namespace shifts with actionable adoption guidance.

Migration verifies historical commits and hashes against the legacy archive, preserves target filenames and source bytes, and writes module-local generation filters. A working default namespace remains available beside disconnected protobuf tool projects. Snapshot aliases, full namespace collisions, changed source state, rollback, and omitted selected/reachable archive sources have explicit failure coverage.

Resolution, tidy and migration now have explicit ownership boundaries. Checked graph results own snapshot evidence; tidy planners consume read-only file observations; transaction writers own staged changes and rollback. Migration groups local-selection proof and candidate construction, and named Git requests state the required proof. These structural changes preserve the public CLI, APIs and configuration formats.

Fresh validation on source 4aa291c98817a716a1877c6e8c0880ea1e045765, standalone tests 548508f9c9c4d15e6c28d233a2fd5b96b475c806 and docs 99b3bcb46116675bd537091c261ae6b85577728d:

• Go 1.26.6, -mod=readonly; fresh CLI and MCP built from the tested source. Go versions and dependencies unchanged.
• Full source go test -race -count=1 ./...: 836 top-level tests, zero failures/skips; 78.3% statement coverage. Test harness unit tests passed with -race too.
• Complete standard v1 standalone suite with -race -count=1: 203 top-level tests and 936 passing test/subtest results in 77.075s, zero skips. This includes Go SDK compilation, managed options/output paths, command plugins, migration wizard, internal aliases, replacements, imported breaking changes, historical modules and cold/frozen replay.
• All 11 live public Git scenarios passed in one sequential cold-cache run (790.566s), including gRPC; every case verified get/tidy/generation, cold frozen download/generation, vendor, identical descriptors and unchanged manifest/lock.
• Python gRPC runtime regressions passed with -race.
• go vet, pinned golangci-lint 2.14.0 (zero issues), pinned Hadolint, schema drift, developer-task dispatch and deterministic native proto example passed.
• GoReleaser 2.18.2 configuration validation and snapshot binary build passed for all 16 CLI/MCP targets, including Linux ARMv6/v7.
• Original final Docker stages built without layer cache for Linux amd64 and arm64, using those Go 1.26.6 binaries. Exact package pins, version, configuration, unchanged lock, lint and deterministic builtin Python generation were verified in both containers.
• Docs typecheck, all 20 stable-release selection tests and production build (684 pages) passed. Source and docs GitHub CI checks passed.
• Independent spec and quality reviews for each implementation/refactor task and final integration reviews were approved.

The external-plugin python_grpc_repro diagnostic was also checked with -race: the working gRPC Python control passed all eight cases, while the pinned Djarvur 90e4d93 generator reproduced six expected AttributeError failures and passed both same-file controls. Captured requests include the correct imported descriptors; running that generator directly on the same request reproduces its identical faulty response. The builtin passes all eight cases. A separate stale-output experiment verified that changing output directories can leave Python loading older bindings; it does not establish the original report's cause. Windows binaries were cross-compiled but not executed locally. Full Docker builder stages and release upload were not run.

Companion PRs: CLI regressions, EN/RU documentation.