Remove the prebuilt download dependency from wheels to sources #1396

Summary

Refactor prebuilt download orchestration so wheels.py does not need to import the heavier sources module.

Context

PR #1393 makes wheels.download_prebuilt_wheel() call sources.download_source(). The reviewer noted that there is no import cycle today, but this dependency direction makes one easier to introduce. Moving staging into the hook resolver was suggested; that choice needs to account for the existing DownloadedSource.path contract, which currently identifies the hook-returned file.

Acceptance Criteria

• Prebuilt download dispatch and staging have a clear owner, and wheels.py no longer imports sources for this path.
• The meaning and ownership of the hook-returned path and staged wheel path are explicit; any DownloadedSource.path contract change is deliberate, documented, and tested.
• Configured pypi-prebuilt and hook-prebuilt, legacy prebuilt, local mirror reuse, build-order replay, and mirror updates retain their intended behavior.
• Focused tests cover hook and non-hook downloads plus cached local mirror URLs.

Definition of Done

• Code and focused tests are complete.
• File-scoped quality checks and CI pass.
• Relevant architecture or hook documentation is updated.
• A PR is reviewed and merged.

Agent Notes

Keep the destination-directory compatibility decision separate. The reviewer accepted the current destinations for this PR. Existing issue #1257 concerns the resolver candidate and URL boundary, so it does not cover this module dependency.