composer: fix incomplete path-repo closures (sugar-glow/stickers/wishlist) + harden checker for transitive gaps

[detain]

Summary

• The candy-forms extraction added a transitive sugarcraft/candy-forms dep to sugar-bits. Three downstream libs that consume sugar-bits (sugar-glow, sugar-stickers, sugar-wishlist) never had the new transitive path-repos added to their repositories[], so a fresh composer install could not resolve candy-forms (the one monorepo lib not yet on Packagist) and failed. sugar-stickers surfaced this as 27 Bits\Viewport not found test errors.
• Completed the full transitive sugarcraft/* path-repo closure for all three libs (added candy-forms plus the rest of each lib's closure: candy-pty, candy-sprinkles, candy-zone, honey-bounce, candy-palette, and the candy-shine sub-tree for sugar-glow).
• Hardened tools/check-path-repos.php: it now walks the full transitive sugarcraft/* require graph (previously only direct requires) and reports the introducing dependency path, so a gap several hops deep — exactly this class of bug — is caught instead of passing as "closure clean". Default mode treats Packagist-published deps as resolvable (matches how Composer actually resolves today); --strict-closure demands a local path-repo for the entire closure regardless, --no-network skips the Packagist probe.
• Docs: added improvements.md §3.7 (found+fixed) and updated the CONTRIBUTING.md line describing the checker.

Checker before/after

Before (flags the 3 broken libs):

  - sugar-glow: missing path-repo for candy-forms (required transitively via sugar-glow -> sugar-bits -> candy-forms)
  - sugar-stickers: missing path-repo for candy-forms (required transitively via sugar-stickers -> sugar-bits -> candy-forms)
  - sugar-wishlist: missing path-repo for candy-forms (required transitively via sugar-wishlist -> sugar-bits -> candy-forms)

After:

check-path-repos: scanned 47 libs
check-path-repos: closure clean

Test plan

• Checker flags the 3 libs BEFORE the composer.json fixes, "closure clean" AFTER.
• Fresh rm -rf vendor composer.lock && composer install + full vendor/bin/phpunit per lib:
  • sugar-glow: install clean, 66 tests, 141 assertions, OK
  • sugar-stickers: install clean, 60 tests, 107 assertions, OK (27 Bits\Viewport not found errors gone)
  • sugar-wishlist: install clean, 70 tests, 180 assertions, OK
• Full-repo resolve scan (composer update --dry-run over every lib): no STILL BROKEN lines.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[codacy-production]

Not up to standards ⛔

🔴 Issues 3 minor

Alerts:
⚠ 3 issues (≤ 0 issues of at least minor severity)

Results:
3 new issues

Category	Results
CodeStyle	3 minor

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}