fix(arborist): safely fallback on unresolved $ dependency references

[owlstronaut]

fixes #5730

Overrides that use a dollar sign need to resolve to a version string found in one of the package’s dependency fields. We now try two sources in order:

Root Manifest (via sourceReference or this.#from.root.package):
When a node is loaded from a sourceReference or if the node is part of a larger tree, the root package manifest is the first choice because it reflects the “authoritative” set of dependency versions that were installed.

Local Manifest (this.#from.package):
If the root manifest does not contain the key (for example, the dependency version isn’t listed there), we fall back to the local package manifest. This is usually more specific to the individual module and may include dependency fields that the root manifest omits.

This two-step lookup ensures that if the expected dependency isn’t available at the root level—even though it might be defined locally—the override can still resolve correctly. Without this fallback, the override resolution would fail with an error, even though the local package had the required dependency version.