Track reachable API definitions in external dependency modules

[ben-ranford]

Outcome

Detect compatibility changes inside dependency types exposed through a public alias or signature, even when the dependency package path and type name remain unchanged.

Evidence and current boundary

Review: #88 (comment) at head3a05494ec0a93b0ee7b7d61b2180ad86a3fbcd0a.

An alias type Public = dep.Value can retain identical inventory text after a dependency update changes Value.Field from string to int, while a consumer api.Public{Field: "x"} no longer compiles. The current named-type walk follows only locally collected hidden definitions and type arguments.

This is a future dependency-bearing root shape, not a current Stave root-module failure: Stave has no third-party root requirements and the API boundary check rejects such root imports. Resolver support is separately tracked in #75; root-local excluded-package reachability is #112.

Acceptance

• Use hermetic local module fixtures representing distinct baseline and candidate dependency versions, with no new production dependency or Go-floor increase.
• Prove the baseline external consumer compiles, the candidate consumer fails after the field change, and independently generated inventories or equivalent baseline-surface evidence reject the candidate.
• Traverse only dependency definitions reachable from exported aliases and signatures, with stable package/type identity, cycle guards and deduplication. Do not inventory unrelated dependency internals.
• Cover unchanged dependency upgrades, additive compatible changes, named versus aliased types, methods, recursive exposed types and constraints deliberately; preserve private method package identity.
• Record dependency graph/build-target inputs and verify determinism on minimum/current Go. Candidate inventory refresh must not suppress a break.
• Keep external resolution (Resolve external module imports in the public-API inventory #75), root-local traversal (Extend release-baseline coverage to reachable root-local internal types #112), and cgo importing (Support cgo-aware release-baseline API inventory #109) as explicit boundaries.

Backlog scope outside the v1.1.0 implementation milestone. Any future API exposing these dependency types requires explicit compatibility review and consumer compilation until this coverage exists.

Bounded reproduction result at PR88 head3a05494

A hermetic external-module alias fixture with a local replacement was blocked by the current inventory resolver, including after fixture-local go mod tidy: it could not resolve example.invalid/dep. No equal-inventory result or silent acceptance was observed for that fixture. Implement and verify #75 before assessing this future reachable-definition gap. The private local reproduction artifacts are retained with the delivery evidence; the review example above is a future coverage hypothesis, not an escaped current-root release gate.