Report effective package source overrides

[caoergou]

Package source settings written by cnpip could be silently superseded by environment variables or project-level configuration, leaving info unable to explain the effective behavior.

This change:

• reports source-related environment variables for pip, uv, PDM, and Conda, with credentials redacted;
• discovers uv and PDM project configuration that can override or extend user-level settings;
• reads Conda's effective channel configuration through the Conda CLI;
• shows override diagnostics in both cnpip info and cnpip list, and warns after set when a higher-precedence setting remains;
• keeps PDM ownership and rollback checks independent of PDM_PYPI_URL;
• documents precedence, extra-index behavior, requirements-file sources, and uv lockfile implications.

Validation:

• ruff check .
• ruff format --check .
• pyright
• pytest -q (176 passed, 1 skipped)
• isolated real-PDM tests (2 passed)
• uv build --out-dir /tmp/cnpip-issue27-dist

Closes #27