Fix git branch dependency cache and lock source

[Sunrisepeak]

Summary

• resolve branch-based git dependencies to a concrete commit before computing the git cache key
• store git dependencies in mcpp.lock as git+...#branch=<name>@<sha> instead of index+...
• extend the git dependency e2e to cover branch updates and lock source metadata
• update the imgui validation notes in .agents/docs

Verification

• mcpp test
• MCPP=<rebuilt-mcpp> bash tests/e2e/23_remove_update.sh
• MCPP=<rebuilt-mcpp> bash tests/e2e/24_git_dependency.sh
• MCPP=<rebuilt-mcpp> bash tests/e2e/62_dotted_dependency_selector_priority.sh
• external imgui-private git consumer imports imgui.core and imgui.backend.glfw_opengl3 with a git lock source pinned to the current branch commit

Notes

This is a mcpp-side fix found while validating imgui-private. It does not publish or modify the public imgui repository or package index.