Validate source providers when build-parallel replays graph.json #1436

Summary

Record each package's source provider in graph.json and reject a graph when build-parallel would replay its saved download URL with a different provider.

Context

PR #1433 adds provider consistency checks for build-sequence and download-sequence, which read build-order.json. build-parallel instead reads graph.json.

Graph nodes save a download URL but not the provider that selected it. When build-parallel runs with different package settings, it can pass that saved URL to the currently selected provider without detecting the mismatch.

Relevant code: src/fromager/dependency_graph.py, src/fromager/bootstrapper/_bootstrapper.py, and src/fromager/commands/build.py.

Acceptance Criteria

Bootstrap records the effective source provider for each package node in graph.json, including prebuilt entries.

build-parallel checks every package node against current settings before starting any package builds. The synthetic root node is excluded.

A mismatch reports the package, recorded provider, and current provider, and tells the user to use matching settings or regenerate the graph.

Graphs without a recorded provider remain usable with legacy settings that select no provider; they fail when current settings select a provider.

Tests cover matching providers, mismatches for source and prebuilt nodes, and older graphs without the field.

The documented graph.json format describes the field and compatibility behavior