Fix: don't develop a dependency's test-only [sources] transitively on Julia <1.11

[ChrisRackauckas-Claude]

Summary

Fixes the bug tracked in SciML/Optimization.jl#1228: every Optimization.jl sublibrary's QA group fails on Julia lts (<1.11) with Aqua Stale dependencies and missing-deps-compat findings for OptimizationLBFGSB and OptimizationManopt, even in sublibraries that have nothing to do with those packages. QA on Julia 1 (>=1.11) is green.

Where the bug lived

The tests.yml reusable workflow's "Develop in-repo [sources] path deps" step (run on Julia <1.11 only) walks the [sources] graph transitively and Pkg.develops every path source it finds. Crucially, when it recursed into an already-developed dependency, it followed that dependency's test-only [sources] too — sources whose names live in [extras]/[targets].test, not in [deps].

OptimizationBase declares [sources] for its own test-only deps OptimizationLBFGSB/OptimizationManopt (so its own test suite resolves on <1.11). Any sublibrary that legitimately sources OptimizationBase (≈26 of them) therefore had OptimizationLBFGSB/OptimizationManopt Pkg.develop-ed into its environment as phantom direct deps. Pkg.develop writes them into the active Project.toml's [deps], and Aqua (run against that sublib) then flags them as stale / missing-compat. On Julia >=1.11 the whole helper is a no-op (VERSION < v"1.11.0-DEV.0"), which is exactly why QA-Julia-1 is green and QA-Julia-lts fails.

This bug is in SciML/.github (the project model tests.yml, which grouped-tests.yml and sublibrary-project-tests.yml both delegate to). It needs a v1 retag to reach consumers. (SciMLTesting.jl's develop_sources! has the same transitive-walk shape for the folder model, but Optimization.jl uses the .github project model; that's a separate follow-up if desired.)

The fix

• Extracted the [sources] walk into scripts/develop_sources.jl (collect_source_paths is a pure, env-mutation-free function; develop_sources activates + develops). tests.yml now checks out SciML/.github at dotgithub-ref (default v1, matching the sibling workflows) and calls the script — one tested source of truth instead of an untested inline block.
• When recursing into a dependency, only follow [sources] entries that are also that dependency's runtime [deps]. A dependency's test-only sources are never developed into the package-under-test's env.
• The package-under-test itself (root of the walk) is exempt: its own test-only [sources] are still developed, because its own test suite legitimately needs them (e.g. testing OptimizationBase directly still develops LBFGSB/Manopt).
• Does not silence Aqua — the phantom deps are never introduced in the first place.

Local verification (Julia 1.10, both directions)

Reproduced against a real Optimization.jl checkout by replicating the workflow's develop step, then running Aqua's stale-deps + deps-compat checks against OptimizationCMAEvolutionStrategy.

(a) Bug reproduced (old, buggy helper): develop step injects OptimizationLBFGSB + OptimizationManopt into CMAES's [deps]; Aqua fails exactly as in the issue:

Stale dependencies: Evaluated: isempty(Base.PkgId[OptimizationLBFGSB […], OptimizationManopt […]])
OptimizationCMAEvolutionStrategy does not declare a compat entry for the following deps:
  OptimizationLBFGSB […]
  OptimizationManopt […]
3 passed, 2 failed

(a) Fix works: with scripts/develop_sources.jl, only OptimizationBase is developed; CMAES's [deps] stays {CMAEvolutionStrategy, OptimizationBase, Reexport, SciMLBase} (no phantom deps); the same Aqua stale-deps + deps-compat checks now pass 5/5, exit 0.

(b) No regression (legitimate transitive runtime developing still works): built a synthetic monorepo Top → Mid → Leaf where Mid runtime-sources Leaf (in [deps]) and test-only-sources TestOnly (only in [extras]/[targets].test). With the fix, developing Top develops the full runtime chain {Mid, Leaf} (precompiles + loads; Top.top_marker() returns through Mid → Leaf), while TestOnly is correctly excluded from Top's manifest. The old helper, by contrast, leaks TestOnly in — confirming the fixture genuinely discriminates the two behaviors.

Owning-repo test suite: julia test/runtests.jl passes on Julia 1.10 and 1.12 (exit 0). Added 3 testsets asserting (1) a dependency's test-only [sources] are excluded while the runtime transitive chain is developed, (2) the root package's own test-only [sources] ARE still developed, (3) no-[sources] → nothing developed. actionlint is clean on the modified tests.yml.

Deploy note

This change is in SciML/.github reusables, so it requires a v1 retag to take effect for consumers (Optimization.jl and the rest of the fleet).

Fixes SciML/Optimization.jl#1228

Please ignore until reviewed by @ChrisRackauckas.