Reject conflicting dataset declarations across manifests

[timlichtenberg]

Problem description

Datasets are declared in per-model manifests plus a shared manifest. Nothing detects two providers declaring the same dataset (same subdir), so a collision silently double-fetches or resolves non-deterministically. This occurred during the MORS migration: MORS and the shared manifest both declared Baraffe until the paired PR removed it.

Preferred solution

On discovery/fetch, detect when two manifest providers declare the same subdir (or dataset key) and fail loudly with an error naming both providers, so a conflict is caught at load time instead of silently resolved.

Raised by @nichollsh in FormingWorlds/PROTEUS#605.

[timlichtenberg]

Part of this is now covered from a different direction. In #27 the dataset location is derived from the dotted table key, so a manifest can no longer declare a location that differs from its key, and two keys within one manifest that differ only in case are rejected because they would share one directory and one registry file on a case-insensitive filesystem.

What this issue still needs is the cross-manifest half: two installed packages declaring keys that resolve to the same directory. Today they load without complaint, and fetch_for keys its result by the dataset key, so one provider's paths silently replace the other's. The check belongs in the discovery step, where every installed manifest is visible at once.