api-gate: two copies of one CRD, and CRDs behind directory links #5170

Describe the bug

api-gate keys its snapshot by (group, plural) and the last file walked wins, so if the tree ships two copies of one first-party CRD, a sizeable change in the copy that loses is not seen while Helm renders both. The walk also does not follow directory links, and Helm does when it packages a chart.

Both are on current main and hit the same-repo gate the same way, forks are not needed. I found them while testing the fork path of the gate in #3440. The first version of this issue had more placements of a CRD that the detector does not see, they were dropped as out of scope in this comment.

To Reproduce

Run api-gate --base <base> --head <head> on two trees. Base has one cozyrd (packages/system/postgres-rd/cozyrds/postgres.yaml). The CRD is the one from sampleCRD in internal/apigate/parse_test.go.

1. Base has packages/chart/crds/widget.yaml. Head changes a field there from string to integer and adds an unused copy of the old CRD as packages/zzz-decoy/widget.yaml.
2. Base has no chart. Head adds packages/chart/Chart.yaml and makes packages/chart/crds a link to a directory outside packages/ and internal/ that holds the CRD.

Expected behaviour

Exit 2 in both cases.

For 1, each copy is checked against its previous version, and a sizeable change in either one is sizeable. Neither copy wins over the other.

For 2, the walk follows directory links as Helm does, and remembers visited targets so a loop cannot hang it.

Actual behaviour

Exit 0, No sizeable API changes detected. Without the decoy file case 1 gives exit 2.

Additional context

Helm v4.3.0.

The tree has no such duplicate today. I scanned main (d32092ac9) with the detector's own discovery and parsing: 3229 YAML files, 31 first-party CRD documents, 3 APIService documents, 31 cozyrds, and none of the 71 (group, plural) keys is defined twice. So the fix is about what happens when a duplicate shows up, and how to pair a copy with its previous version when files move is still open.