[Build] Eliminate conflicting swift-nio-ssl package identities

[stephenlclarke]

Defect

The package graph introduces swift-nio-ssl through both github.com/apple/swift-nio-ssl and github.com/stephenlclarke/swift-nio-ssl. SwiftPM treats them as the same package identity, warns on every build, and says the conflict will be an error in a future release.

Evidence

The 6 September 2026 focused EngineSocketGrantTests build reported the conflict through async-http-client, swift-nio-extras, and grpc-swift-nio-transport.

Required outcome

• Resolve every dependency chain to one reviewed repository URL and immutable revision.
• Prefer a deterministic package mirror/override or a consistently fork-pinned graph rather than graph-order selection.
• Add a resolver preflight that fails immediately if conflicting identities reappear.
• Prove the warning is absent on a clean resolve and the release graph remains at the intended fork revision.

Parent programme: stephenlclarke/container-compose#324.

[stephenlclarke]

The identity conflict remains reproducible on every filtered run. On 2026-09-06, two consecutive tests with no intervening source change both re-entered package planning and emitted traversal chains that alternated between async-http-client and grpc-swift-nio-transport before selecting the Stephen fork. The commands then rebuilt plugins/dependencies (67.67s and 58.80s). The warning already says this becomes a future resolver error; graph selection must be made single-source and deterministic.