Fix spool source handling and registry filtering

[d-chambers]

Summary

Fixes two related areas in the spool/widget workflow:

• Treat incoming spool inputs as transform sources instead of appending
  them to the current spool.
• Avoid materializing lazy multi-row spools when deciding whether to emit
  a single unpacked patch.
• Restrict DerZug widget discovery/registry filtering so external packages
  registered under the same entry point group are not treated as core DerZug
  widgets.

Root Cause

The live Orange registry could include third-party widgets registered
through the derzug.widgets entry point group. Those widgets were then
picked up by DerZug-only registry integration checks and failed DerZug-
specific module/workflow contract assertions.

Separately, single-patch extraction could iterate a lazy spool even when
metadata already showed it had multiple rows.