feat(pm): dispatch-gates derivation follows first-party imports (#11190) (#11512)

`resolveCheckToFiles` reads a family's script paths out of the npm script's
command string and `discoverFamilies` scanned exactly those files, so a module
a gate imports was never opened: a population declaration moved out of a gate
and into a shared module stopped contributing hints to every gate that imports
it, with every gate still green and nothing in the output saying so.

`firstPartyImportTargets` resolves the relative static import specifiers of a
gate script one level down, inside the repo's own scripts/ tree, never into
node_modules and never into a module that is itself a discovered gate file.
Hints from a followed module are appended after every own hint, so no existing
match changes key or provenance, and `entry.hintOrigin` carries which module
contributed each inherited hint into `coveringKey`'s via column.

Measured over 140 discovered families x 6460 tracked files:

  watch-hint (gate, file) pairs   51848 -> 52741  (+893, ZERO lost)
  families gaining coverage       6
  existing matches re-attributed  0

Every refusal carries its own measurement in the docblock: following gate
modules too costs +4907 instead of +893 (3065 of the difference is one family
inheriting a repo-wide declaration table from a gate it imports one string
helper from), reaching outside scripts/ costs +2517 more, dynamic import()
adds +0, and depth 2 and depth 3 add +0.

The self-test's pin of the old constraint is inverted rather than deleted, and
every case now names its specimen with a count: measured, the old pin would
NOT have gone red on this change, because it picked its specimen by iteration
order and landed on a family whose imported module declares no path at all.


Claude-Session: https://claude.ai/code/session_015ahemw8RcTgqtxrj15PEZx

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]