[MilesCranmerBot]

Summary

deps_files() collects <entry>/<package>/juliapkg.json for every entry on sys.path. When a package appears in more than one entry, all copies are merged, although Python imports only the first. This happens when running Python inside a source checkout that is also installed non-editably: the current directory comes first on sys.path, so Python imports the checkout while site-packages holds a second copy.

Identical copies merge harmlessly. Copies that set a relative path resolve it against their own directories, so they differ and find_requirements() fails with 'path' entries are not unique. Copies at different versions merge their compat bounds even though only one is imported.

This change keeps only the first juliapkg.json for each package name found along sys.path, matching import order. Top-level juliapkg.json files and editable-install discovery are unchanged.

Testing

• uv run pytest: 127 passed, 5 skipped (126 passed on main; the difference is the new test).
• The new test_deps_files_skips_shadowed_package puts two copies of a package on sys.path. It fails on main and passes with this change.
• Reproduced with a package whose juliapkg.json uses a relative path, installed non-editably and imported from its checkout. find_requirements() fails on main and succeeds with this branch, selecting the checkout's path, which is the copy Python imports.

[MilesCranmer]

@cjdoris this fixes an issue I had when trying to ship a julia package saved inside the python source, and reference it via the "path" key in juliapkg.json.

[cjdoris]

Thanks!