v0.48.0

fix: resolve virtual deps from selected packages (#531)

Prefer already-selected providers to avoid ambiguity during installs

When a package declares `requires = ["jdk"]`, Hermit may treat `jdk` as
a virtual dependency. If multiple packages provide `jdk` and none are
installed yet, Hermit previously refused to choose and failed, even if
the user explicitly requested a provider (like `openjdk@21`) in the same
install command.

The change makes Hermit prefer *already-selected* packages in the
current install set when resolving virtual dependencies. That means if
you run:

```
hermit install openjdk@21 some-package-requiring-jdk
```

Hermit sees that `openjdk@21` is part of the install selection and uses
it to satisfy `jdk`, avoiding the “multiple packages satisfy” error.

This PR also lets a package declare virtual dependencies in
`runtime-dependencies` like you already could for `requires`