Add `source_resolver` dispatch to download pipeline

[smoparth]

Context

After the source field is activated (Phase 1), the download pipeline needs to dispatch to the new system when a package has source: config.

Parent epic: #1254 (Phase 3)

What needs to happen

Add a dispatch check in sources.download_source():

def download_source(*, ctx, req, version, download_url):
    pbi = ctx.package_build_info(req)

    if pbi.source_resolver is not None:
        # New path: source_resolver handles download
        path, download_kind = pbi.source_resolver.download(ctx, req, candidate)
        return path
    else:
        # Legacy path: unchanged
        source_path = overrides.find_and_invoke(
            req.name, "download_source", default_download_source, ...
        )
        return source_path

Open design question

The current download_source() signature takes download_url: str, but the new source_resolver.download() needs a Candidate object (which has url, version, name). The implementer needs to decide how to bridge this:

• Option A: Thread Candidate through the pipeline from resolution to download (cleaner, larger change to callers)
• Option B: Construct a minimal Candidate from download_url + version + req.name at the dispatch point (smaller, pragmatic)

Return value change

The new path returns (path, DownloadKind) tuple. The DownloadKind is needed by Phase 4 (prepare_source and build_sdist). The implementer should decide whether to:

• Return the tuple from download_source() (breaking change to callers)
• Store DownloadKind on context or pass it separately

Files

• src/fromager/sources.py — download_source()
• Callers in src/fromager/bootstrapper/ (may need signature changes)

Tests

• Package with source: {provider: pypi-sdist} → source_resolver.download() called
• Package without source: → legacy default_download_source() path used
• DownloadKind is correctly propagated for Phase 4

Depends on

• Phase 1: Activate source field + PBI property

Related

• Phase 4 (Wire prepare_source and build_sdist for git-clone-based source resolvers #1205, build_sdist uses tarball instead of PEP 517 #1206): Prepare + build_sdist depends on this
• Phase 8: Command integration depends on this