Make an explicit local Registry root authoritative over cache

[rudijetson]

Problem

When USE_LOCAL_REGISTRY=true and RUDI_REGISTRY_ROOT selects an explicit checkout, fetchIndex() can still return a newer or equal-mtime cache created from a different local root. CI exposed this as a repeated resolver test failure: one test received the previous fixture's package contract.

Evidence

• PR fix: move Codex to provider-owned standalone install #14 initially failed, then passed on rerun
• PR fix: terminate tool-index process trees #18 failed with the identical wrong-fixture assertion
• 100 isolated Node 20 focused runs passed because they did not reproduce the cross-fixture cache path
• the stale result occurs when the fixed cache path outlives a switched RUDI_REGISTRY_ROOT and its mtime wins

Scope

• make a valid explicitly configured local Registry index authoritative
• retain existing mtime/cache behavior for auto-discovered local roots
• add a deterministic regression with an intentionally newer stale cache
• keep this fix independent of the feature PR stack

Acceptance

• regression fails before the fix for the expected stale-cache reason
• explicit local root wins even when its index mtime is older than cache
• normal cached/remote Registry behavior remains covered
• full tests, build, debt scan, package dry run, and diff checks pass