Import-layer debt baseline: key rows by statement, and name forbidden targets #2125

Non-blocking follow-ups from the review of #1924:

1. Debt rows are keyed by line number, so an unrelated edit that shifts lines above a debt site fails the ratchet until the baseline is edited and re-pinned. Key each row by a stable statement identity instead, such as the enclosing qualified name plus a normalized AST hash of the import statement, so only real changes to a debt site fail.
2. Alias and constant-held dynamic-import probes are reported as unresolved sites without naming the forbidden target they reach. Include the resolved target, where it's statically known, in the diagnostic.