fix(build): fingerprint injected Go source patch bodies

[cpunion]

Problem

Injected Go source patches are added to CompiledGoFiles after go list, but the package cache fingerprints only GoFiles. Editing an injected function body can therefore silently reuse a stale archive. This is a shared main issue found while validating R4's syscall timestamp fix.

Fix

• Include selected overlaid CompiledGoFiles in Go source inputs, without double-counting original files.
• Apply the same rule to alternate packages.
• Keep unselected overlays out of the cache key.
• Add a regression that changes only an injected patch body and verifies invalidation.

Validation

Focused build/fingerprint tests pass on LLVM 22, independently on upstream main be23e48. R4 also carries the same fix and has passed its cache-enabled wide-stat regression. CI is still required before upstream contribution.

This PR is independent of the WASM runtime changes in #235. Its base is the existing main snapshot branch at be23e48, not the R4 feature branch.

[cpunion]

Moved to xgo-dev#2527 as requested. Fork CI had already completed and there are no active workflow runs to cancel. Keeping the source branch for the upstream contribution.