Tweak solver's same-origin heuristic

[jonjohnsonjr]

Previously, we'd always prefer providers of constraints that come from the same origin as a package we'd already selected. This made it very difficult to move a package to a different origin, as the heuristic would select the older version of an APK that matched the same origin.

This change tracks not just origins we've already selected, but the version of that origin, so we don't end up stuck on an older version.

[xnox]

One interesting test case for this is "pinning down one package, and expect the rest to match" which is an often expected behaviour.

Currently given this apko.yaml:

contents:
  repositories:
    - https://apk.cgr.dev/chainguard
  packages:
    - openssh=10.2_p1-r0

archs:
  - amd64

This results in openssh metapackage to be pinned down, yet all other client/server packages are actually still resolved to latest 10.3 version

$ apko show-packages openssh.yaml | grep openssh
2026/05/05 20:24:13 INFO Determining packages for 1 architectures: [amd64]
openssh-client 10.3_p1-r0
openssh-keygen 10.3_p1-r0
openssh-server-config 10.3_p1-r0
openssh-server 10.3_p1-r0
openssh-sftp-server 10.3_p1-r0
openssh 10.2_p1-r0

With this PR however, they all correctly transitively pin-down to the same origin version, as actually expected by customers

$ apko show-packages openssh.yaml | grep openssh
2026/05/05 20:21:28 INFO Determining packages for 1 architectures: [amd64]
openssh-client 10.2_p1-r0
openssh-keygen 10.2_p1-r0
openssh-server-config 10.2_p1-r0
openssh-server 10.2_p1-r0
openssh-sftp-server 10.2_p1-r0
openssh 10.2_p1-r0

[xnox]

Full image lock looks good, there are a couple package version downgrades, which are expected based on this change and are more accurate and correct resolution.

There is one resolution failure, which is absolutely correct as a subpackage was removed and yet the lock is trying to use mismatched packages.

[xnox]

Interesting lock changes:

diff --git a/images/google-cloud-sdk-iamguarded/package_lock.cue b/images/google-cloud-sdk-iamguarded/package_lock.cue
index fb6aea05f5d..bb28e77540c 100644
--- a/images/google-cloud-sdk-iamguarded/package_lock.cue
+++ b/images/google-cloud-sdk-iamguarded/package_lock.cue
@@ -38,7 +38,7 @@ pkgLocks: {
                        "py3-pip-wheel=26.0.1-r2",
                        "py3-setuptools-wheel=82.0.1-r0",
                        "py3.11-crcmod=1.7-r11",
-                       "py3.11-google-cloud-sdk=543.0.0-r0",
+                       "py3.11-google-cloud-sdk=565.0.0-r0",
                        "py3.13-crcmod=1.7-r11",
                        "py3.13-google-cloud-sdk=565.0.0-r0",
                        "python-3.11-base=3.11.15-r2",
@@ -100,7 +100,7 @@ pkgLocks: {
                        "py3-pip-wheel=26.0.1-r2",
                        "py3-setuptools-wheel=82.0.1-r0",
                        "py3.11-crcmod=1.7-r11",
-                       "py3.11-google-cloud-sdk=543.0.0-r0",
+                       "py3.11-google-cloud-sdk=565.0.0-r0",
                        "py3.13-crcmod=1.7-r11",
                        "py3.13-google-cloud-sdk=565.0.0-r0",
                        "python-3.11-base=3.11.15-r2",
@@ -148,7 +148,7 @@ pkgLocks: {
                        "py3-pip-wheel=26.0.1-r2",
                        "py3-setuptools-wheel=82.0.1-r0",
                        "py3.11-crcmod=1.7-r11",
-                       "py3.11-google-cloud-sdk=543.0.0-r0",
+                       "py3.11-google-cloud-sdk=565.0.0-r0",
                        "py3.13-crcmod=1.7-r11",
                        "py3.13-google-cloud-sdk=565.0.0-r0",
                        "python-3.11-base=3.11.15-r2",
diff --git a/images/kubernetes-reflector/package_lock.cue b/images/kubernetes-reflector/package_lock.cue
index 25c8fd3e8c6..cbfc1a855a0 100644
--- a/images/kubernetes-reflector/package_lock.cue
+++ b/images/kubernetes-reflector/package_lock.cue
@@ -17,8 +17,7 @@ pkgLocks: {
                        "glibc=2.43-r7",
                        "icu-data-full=75.1-r42",
                        "icu-libs=75.1-r42",
-                       "icu78-data-full=78.3-r1",
-                       "icu=78.3-r1",
+                       "icu=75.1-r42",
                        "kubernetes-reflector-compat=10.0.40-r0",
                        "kubernetes-reflector=10.0.40-r0",
                        "ld-linux=2.43-r7",
@@ -27,7 +26,6 @@ pkgLocks: {
                        "libcrypto3=3.6.2-r3",
                        "libexpat1=2.8.0-r0",
                        "libgcc=15.2.0-r11",
-                       "libicu78=78.3-r1",
                        "libssl3=3.6.2-r3",
                        "libstdc++=15.2.0-r11",
                        "libunwind=1.8.3-r4",
@@ -54,8 +52,7 @@ pkgLocks: {
                        "heimdal-libs=7.8.0-r48",
                        "icu-data-full=75.1-r42",
                        "icu-libs=75.1-r42",
-                       "icu78-data-full=78.3-r1",
-                       "icu=78.3-r1",
+                       "icu=75.1-r42",
                        "keyutils-libs=1.6.3-r38",
                        "krb5-conf=1.0-r9",
                        "krb5-libs=1.22.2-r2",