Use snapshotted package metadata

[mini-1235]

Summary

• load package.xml from each package's URL and ref in rosdistro_snapshot.yaml
• use snapshot manifests for recursive dependency discovery
• make snapshot membership and package enumeration independent of the current live rosdistro
• preserve the existing live-rostdistro behavior when no snapshot is configured
• add package-agnostic regression coverage for source, version, manifest, dependency, recipe, and membership consistency

Problem

Vinca already used snapshot data for a recipe's source URL, ref, and version, but it continued to use the current live rosdistro cache for package.xml, package membership, package enumeration, and recursive dependency walking. If package metadata changed after the snapshot was created, a generated recipe could therefore combine old source with new dependencies.

A concrete example is moveit_py in Rolling:

• MoveIt 2.14.1 package.xml depends on pybind11_vendor, and its CMake configuration requires pybind11_vendor.
• MoveIt 2.15.0 package.xml instead depends on pybind11-dev, and its CMake configuration no longer requires the vendor package.

With a 2.14.1 snapshot and live 2.15.0 metadata, Vinca omitted the ROS vendor package required by the pinned source and the build failed while looking for pybind11_vendorConfig.cmake.

Fix

When a non-empty snapshot is active, this patch makes it authoritative for package-level data. Pinned manifests are fetched through the existing GitHub, GitLab, or archive paths and cached. Recursive ROS dependencies are then derived from those manifests, with package conditions evaluated and non-ROS dependencies left for normal conda dependency resolution.

The regression tests use synthetic snapshot and live releases with deliberately different dependencies. They verify that the generated recipe contains only the dependency required by the pinned source and that an empty snapshot still follows live rosdistro.

Fixes #93.

Validation

• pytest -q vinca/ — 117 passed
• ruff check vinca/distro.py vinca/main.py vinca/test_snapshot_metadata.py
• ruff format --check vinca/distro.py vinca/main.py vinca/test_snapshot_metadata.py
• live probe against the pinned Rolling MoveIt 2.14.1 release manifest confirmed pybind11_vendor is selected and live-only pybind11-dev is absent

[mini-1235]

I am seeing the same issue in RoboStack/ros-rolling#31, which is what led me to open this PR. However, I noticed that this has been a longstanding issue since last year, with little activity so far.

For now, I am opening this as a draft to get the maintainers' thoughts and see whether there is interest in pursuing this approach before I spend more time manually validating it :)

[traversaro]

However, I noticed that this has been a longstanding issue since last year, with little activity so far.

And that is why this PR is really great, thanks a lot for working on this!

[traversaro]

For now, I am opening this as a draft to get the maintainers' thoughts and see whether there is interest in pursuing this approach before I spend more time manually validating it :)

It is definitely interesting, this issue hit me several time in the past as well.

[mini-1235]

For now, I am opening this as a draft to get the maintainers' thoughts and see whether there is interest in pursuing this approach before I spend more time manually validating it :)

It is definitely interesting, this issue hit me several time in the past as well.

Great, I can take another look at this issue once I have cleared the PRs I need to prioritize, probably by the end of August. I will let you know when this is ready to review