Avoid fetching shadowed global Git packages at project startup

[junior-ricon]

What happened

Pi fetches a user-scoped Git package even when a project-scoped entry for the same repository shadows it.

Observed with KKL Pi 0.81.0-kkl.2:

• ~/.pi/agent/settings.json contains git:github.com/ricon-family/ricon-pi@v0.3.0.
• Project .pi/settings.json contains git:github.com/ricon-family/ricon-pi@v0.4.0.
• Every interactive startup from that project prints:

From https://github.com/ricon-family/ricon-pi
 * tag               v0.3.0     -> FETCH_HEAD

The project package wins as documented and its project cache is correctly checked out at v0.4.0 source 9dc2bf95d277bd4a9509017265f724b3c1474caa. The losing global cache is not loaded at v0.3.0; Pi nevertheless fetches that global ref on every startup.

Expected

Once package identity is known from the Git repository URL and the project entry wins, Pi should not fetch or reconcile the shadowed global entry. At minimum, startup should not emit misleading fetch output for a package that will not load.

Notes

docs/packages.md says package identity for Git sources is the repository URL without the ref and that the project entry wins when the same package appears in both scopes.

This report is from the released KKL runtime. We did not have time to reduce it to a standalone fixture or determine whether upstream Pi 0.82.1 already changed the behavior.