Report the source each deployed artifact resolved from

[williamthorsen]

Problem

When sync deploys artifacts resolved through declared sources:, nothing surfaces which source each artifact resolved from. A declared source silently shadows a library slug of the same name, and that shadow is undiagnosable — no surface attributes a deployed artifact to its origin.

Context

Source resolution is transparent by design: declared sources shadow the library, and later sources shadow earlier ones. The resolver already computes each artifact's origin (ResolvedArtifactSource.source, undefined = library) but drops it after resolution — no deployed-artifact record or output carries it forward.

Proposed solution

Thread the resolving source onto each deployed artifact's resolved record (ResolvedRulebook, ResolvedSkill, ResolvedSubagent), then surface it two ways:

• --dry-run: a per-artifact resolution report naming each deployed rulebook, skill, and subagent's origin — a declared source by name, or the built-in library — flagging any artifact whose slug also exists in the library as shadowing it.
• Real run: a concise warning when any deployed artifact shadows a library slug (the full per-artifact report stays dry-run-only).

Shadow detection probes the library for the same (type, slug) and runs only for source-resolved artifacts, off the normal deploy path.

Acceptance criteria

Must have

• sync --dry-run reports, per deployed artifact (rulebook, skill, subagent), the source it resolved from — a declared source's name, or the built-in library.
• A source-resolved artifact whose slug also exists in the library is flagged as shadowing it in the --dry-run report.
• A real sync run emits a concise warning when any deployed artifact shadows a library slug.
• New and modified behavior is covered by tests.