Consider a shared module for sequence replay validation #1435

Context

PR #1433 adds check_source_providers() to
src/fromager/commands/build_order.py. Both build-sequence and
download-sequence use it.

That module otherwise contains the build-order CLI group and commands
for converting and summarizing build-order files.

Why revisit this

The current placement works and introduces no import cycle. If more
replay-validation helpers are added, mixing them with CLI commands could
make the validation code harder to find and maintain.

Follow-up

When adding more replay validation, consider whether a shared module
(such as commands/_replay.py) would be useful.

If extraction is warranted:

• Keep related validation helpers together and reuse them across commands.
• Preserve the current provider checks and URL-skipping behavior.
• Keep existing coverage for legacy, configured-source, prebuilt, and
  fallback entries.

Scope

Non-blocking cleanup from the review of #1433. No immediate refactor or
change to replay policy is required.

Related: #1418.

Review comment:
#1433 (comment)