Honor direct URL constraints when validating metadata-free locks (#20796)
## Summary
Metadata-free lock freshness validation reconstructs dependency edges
from refreshed workspace requirements, but previously compared
constraints only against the lock manifest. That rejected valid locks
when an unqualified dependency was selected by a direct-URL constraint,
including selections shared across disjoint platform markers.
Carry normalized constraints into edge reconstruction and accept a
direct source only when an applicable, same-name constraint selects that
exact locked source. Cover constrained extras and disjoint-platform
direct sources with offline, uncached workspace regressions.