fix(pool-builder): use plain getPackages() on locked repository

PoolBuilder::build_pool() and warn_about_non_matching_update_allow_list()
called get_canonical_packages() on the locked repository during a
partial update, but PHP's PoolBuilder uses the plain getPackages().
get_canonical_packages() unwraps AliasPackage down to its base package,
discarding the alias's own version identity.

Locker::get_locked_repository() wraps a lock entry with
extra.branch-alias in a single CompleteAliasPackage rather than adding
a separate base object, so canonicalizing it silently dropped the
locked branch-alias version (e.g. 2.2.x-dev), leaving only the raw
dev-master version behind. For a package excluded from the partial
update's allow-list, that meant its locked branch-alias version could
no longer satisfy the root's constraint, producing a spurious solver
conflict instead of keeping the package pinned exactly as locked.

Fixed the same bug in AuditCommand's --locked package listing, which
had the identical get_canonical_packages()/getPackages() mismatch
against AuditCommand.php.

1 files changed, 3 insertions, 3 deletions

diff --git a/crates/shirabe/src/dependency_resolver/pool_builder.rs b/crates/shirabe/src/dependency_resolver/pool_builder.rs
index 00d6b938..15cac540 100644
--- a/crates/shirabe/src/dependency_resolver/pool_builder.rs
+++ b/crates/shirabe/src/dependency_resolver/pool_builder.rs
@@ -14,8 +14,8 @@ use crate::package::CompleteAliasPackageHandle;
 use crate::package::PackageInterfaceHandle;
 use crate::package::base_package;
 use crate::package::version::StabilityFilter;
-use crate::repository::CanonicalPackagesTrait;
 use crate::repository::PlatformRepository;
+use crate::repository::RepositoryInterface;
 use crate::repository::RepositoryInterfaceHandle;
 use crate::repository::RootPackageRepository;
 use indexmap::IndexMap;
@@ -159,7 +159,7 @@ impl PoolBuilder {
                 .get_locked_repository()
                 .unwrap()
                 .borrow_mut()
-                .get_canonical_packages()?
+                .get_packages()?
             {
                 if !self.is_update_allowed(locked_package.clone()) {
                     // remember which packages we skipped loading remote content for in this partial update
@@ -815,7 +815,7 @@ impl PoolBuilder {
                 .get_locked_repository()
                 .unwrap()
                 .borrow_mut()
-                .get_canonical_packages()?
+                .get_packages()?
             {
                 if Preg::is_match3(&pattern_regexp, &package.get_name(), None) {
                     continue 'outer;