test: add coverage for source pipeline (sources.py)

[mnadzam]

src/fromager/sources.py has 43% unit test coverage. This module is the backbone of fromager's source acquisition and preparation pipeline -- every package processed flows through these functions.

Functions that already have dedicated unit tests:

• resolve_source(), patch_source(), prepare_new_source(), validate_sdist_filename(), scan_compiled_extensions(), _download_source_check() (partial)

Scope -- Untested Functions

Function	Lines	Role
get_source_type()	45	Classifies source as SDIST/GIT/OVERRIDE
download_source()	60	Main download dispatcher (mocked in other tests but never directly tested)
download_git_source()	226	Git clone with ref/tag handling
download_url()	296	HTTP download with retry and temp file handling
unpack_source()	387	Tarball extraction
write_build_meta()	479	Build metadata serialization
read_build_meta()	499	Build metadata deserialization
prepare_source()	507	Source preparation dispatcher (mocked in other tests but never directly tested)
default_prepare_source()	559	Dependency preparation
build_sdist()	619	SDist build dispatcher
default_build_sdist()	683	Default sdist build
pep517_build_sdist()	723	PEP 517 sdist building
ensure_pkg_info()	756	PKG-INFO validation

Acceptance Criteria

• get_source_type() -- test dispatch for sdist URLs, git URLs, and override settings
• download_source() -- test git URL parsing (url@ref format) and dispatch paths
• unpack_source() -- test extraction success, directory renaming, and corrupt archive error handling
• write_build_meta() / read_build_meta() -- test round-trip serialization
• prepare_source() -- test plugin return handling (Path vs tuple)
• ensure_pkg_info() -- test stub creation when PKG-INFO is missing
• build_sdist() -- test validation logic with mocked build environment