fix(oa009): declaration guard resolves against the root manifest, diverging from PD001

[sonukapoor]

Note: this is an in-house item already being handled by the maintainer - not open for contribution. Filed for tracking only.

Surfaced while reviewing #1114, which resolves PD001/PD002 declarations against the nearest enclosing workspace member. OA009's safety guard was not updated to match, so after that lands the two rules disagree.

The guard

src/overrides/detectors/oa009-stale-floor.ts:59-62

if (ctx.importedPackageNames.has(entry.packageName)) {
  const declared = getDeclaredPackages(ctx.packageJson);   // root manifest only
  if (!declared.has(entry.packageName)) continue;
}

The guard exists so OA009 stays quiet when removing an override would create a phantom import that PD001 would then report. Once PD001 resolves per workspace member, a package declared in apps/web/package.json but not at the root makes PD001 correctly fall silent while OA009 still suppresses itself. The result is a genuinely redundant override floor that no rule reports.

Fix: call the shared undeclaredImportFiles from phantom-utils so both rules answer the declaration question the same way.

Second, smaller problem in the same lines

OA009 carries its own private getDeclaredPackages (oa009-stale-floor.ts:13) reading only dependencies and devDependencies, while phantom-utils.getDeclaredPackages reads four sections including peerDependencies and optionalDependencies. Two functions, same name, different semantics. A package declared only as a peer dependency is invisible to OA009's guard.

Pre-existing, but worth fixing in the same pass.

Severity

OA009 is low, and the failure is a missed finding rather than a false one, so this is not urgent. It should land soon after #1114 so the two rules do not stay out of step, and website/docs/override-hygiene/pd001.md still states that PD001 and OA009 pair up.