feat(source-files): wire archive overlays into prep-sources with post-overlay hash tracking

[Tonisal-byte]

Wires archive-scoped overlays into the source preparation pipeline.

This applies archive overlays during prep-sources, repacks modified archives, refreshes their sources file hashes, and adds origin.type = "overlay" for recording expected post-overlay archive hashes. It also ensures overlay-origin source files are not downloaded separately and validates stale configured hashes during full source prep.

Example:

# Declares the expected post-overlay archive hash. This must have the same
# filename as the archive targeted below and replaces its upstream `sources`
# entry during render.
[[components.example.source-files]]
filename = "example-1.0.tar.gz"
hash = "..."
hash-type = "SHA2512"
origin = { type = "overlay" }
replace-upstream = true
replace-reason = "Remove bundled vendor files not shipped by Azure Linux"

# Multiple archive overlays can use the same overlay-origin entry.
[[components.example.overlays]]
type = "file-remove"
archive = "example-1.0.tar.gz"
file = "vendor/**"
description = "Remove bundled dependencies"

[Copilot]

Pull request overview

This PR wires archive-scoped overlays into the prep-sources pipeline: archives modified by overlays are deterministically repacked, their corresponding sources entries are re-hashed, and configuration can record/validate expected post-overlay hashes via a new origin.type = "overlay" source-file origin.

Changes:

• Add new OriginTypeOverlay / schema enum value "overlay" and associated config validation rules for overlay-origin source-files entries.
• Apply archive overlays during prep-sources, repack modified archives, and rehash only the affected sources entries; additionally validate configured post-overlay hashes during full prep.
• Adjust Fedora lookaside extraction to avoid skipping files that are not actually fetched by FetchFiles (e.g., overlay-origin entries).

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
schemas/azldev.schema.json	Adds "overlay" to the origin.type enum in the JSON schema.
scenario/snapshots/TestSnapshotsContainer_config_generate-schema_stdout_1.snap	Updates schema snapshot output for the new enum value.
scenario/snapshots/TestSnapshots_config_generate-schema_stdout_1.snap	Updates schema snapshot output for the new enum value.
internal/providers/sourceproviders/sourcemanager.go	Skips downloads for overlay-origin refs; refactors provider attempts into helper; adds internal guard for overlay origin in download path.
internal/providers/sourceproviders/fedorasourceprovider.go	Avoids skipping upstream lookaside downloads for non-fetched origin types (e.g., overlay).
internal/projectconfig/fingerprint_test.go	Improves fingerprint tag parsing/validation to account for hashstructure tag options.
internal/projectconfig/configfile.go	Adds overlay-origin validation rules and calls archive-overlay/origin validation during config validation.
internal/projectconfig/configfile_test.go	Adds validation coverage for archive overlay requiring an overlay-origin entry.
internal/projectconfig/component.go	Introduces OriginTypeOverlay, OriginType.IsFetched, and ValidateArchiveOverlayOrigins.
internal/app/azldev/core/sources/sourceprep.go	Applies archive overlays first, tracks repacked archives, rehashes corresponding sources entries, and validates configured post-overlay hashes.
internal/app/azldev/core/sources/sourceprep_test.go	Adds end-to-end tests around archive overlay repacking + sources rehashing behavior.
internal/app/azldev/core/sources/archiveoverlays.go	Implements batching of archive overlays per archive (single extract/modify/repack cycle per archive).
internal/app/azldev/core/sources/archiveoverlays_test.go	Adds coverage for archive overlay glob semantics and end-to-end behavior via PrepareSources.
internal/app/azldev/core/sources/archiveoverlays_internal_test.go	Adds direct unit coverage for archive overlay grouping behavior.
internal/app/azldev/core/components/resolver.go	Validates archive overlay/origin invariants after config resolution/overlay-file expansion.
docs/user/reference/config/overlays.md	Documents drift-protection requirement for archive overlays via overlay-origin source-files.
docs/user/reference/config/components.md	Documents the new "overlay" origin type and the workflow for recording post-overlay hashes.

[Copilot]

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 24 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

internal/projectconfig/configfile.go:180

• The new comment says overlay-origin entries require 'hash' and 'hash-type', but the implementation explicitly allows hashes to be omitted for '--allow-no-hashes' bootstrapping (see validateOverlayOriginRef + downstream source prep behavior). This mismatch makes the validation rules unclear for future maintainers.

//   - [OriginTypeOverlay] entries additionally require 'hash', 'hash-type', and 'replace-upstream = true'.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 24 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

internal/projectconfig/configfile.go:180

• The validateSourceFiles comment says OriginTypeOverlay entries require 'hash' and 'hash-type', but the implementation explicitly allows omitting them during '--allow-no-hashes' bootstrapping (and there is a test covering that). This comment is misleading; update it to match the actual validation behavior.

//   - Hash type must be a supported algorithm when specified.
//   - Hash value without a hash type is not allowed.
//   - Origin must be present and valid for each source file.
//   - 'replace-upstream' and 'replace-reason' must be set together.
//   - [OriginTypeOverlay] entries additionally require 'hash', 'hash-type', and 'replace-upstream = true'.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 24 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

internal/projectconfig/configfile.go:180

• The validateSourceFiles header comment says [OriginTypeOverlay] requires 'hash' and 'hash-type', but validateOverlayOriginRef only enforces 'replace-upstream = true', and hashes are intentionally allowed to be omitted for '--allow-no-hashes' bootstrapping. This comment is currently inaccurate and could mislead future changes.

//   - [OriginTypeOverlay] entries additionally require 'hash', 'hash-type', and 'replace-upstream = true'.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 24 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

internal/projectconfig/configfile.go:180

• The validateSourceFiles doc comment says OriginTypeOverlay entries “additionally require 'hash'”/“hash-type”, but this validator explicitly allows overlay-origin refs to omit hashes for '--allow-no-hashes' bootstrapping (and there’s a test asserting that). Update the comment so it matches the actual validation behavior (replace-upstream is required; hash/hash-type may be omitted only for bootstrapping).

//   - 'replace-upstream' and 'replace-reason' must be set together.
//   - [OriginTypeOverlay] entries additionally require 'hash', 'hash-type', and 'replace-upstream = true'.

internal/projectconfig/component.go:70

• This PR updates [Origin] to state that an origin is required for every 'source-files' entry, but [SourceFileReference.Origin] later in this file is still documented/tagged as optional (and the generated schema likely still allows omitting origin). That mismatch can confuse users because config validation will reject missing origin.type. Consider making origin required in the schema (via struct tags/jsonschema annotations), updating the SourceFileReference field comment/tag, and regenerating schema + snapshots.

// Origin describes where a source file comes from and how to retrieve it.
// An origin is required for every 'source-files' entry.
type Origin struct {
	// Type indicates how the source file should be acquired.
	Type OriginType `toml:"type" json:"type" jsonschema:"required,enum=download,enum=custom,enum=overlay,title=Origin type,description=Type of origin for this source file" fingerprint:"-"`