[Bug: new-resolver-config feature branch] Reject source and legacy settings mixed across package and variant levels #1368

Summary
A package-level source can be combined with variant-level legacy source settings. Validation accepts the config even though the effective settings for that variant conflict.
Context
PR #1307 added separate validators to PackageSettings and VariantInfo. The package validator checks package-level legacy fields, the variant validator returns early when that variant has no source. Neither catches a conflict spread across both levels.
This affects the new-resolver-config feature branch.

Steps to reproduce
Load these package settings with PackageSettings.from_string() and select the cpu variant:

source:
  provider: pypi-sdist
variants:
  cpu:
    pre_built: true

The config loads. For cpu, PackageBuildInfo.source_resolver could return PyPISDistResolver, while PackageBuildInfo.pre_built is True.

Expected behavior
Loading the config raises a clear validation error identifying source and variants.cpu.pre_built, before resolution or building begins.

Acceptance Criteria

• Reject package-level source combined with an explicitly set variant pre_built or wheel_server_url.
• Check the converse case under Add mutual exclusivity validator for source vs legacy fields #1207’s rule: variant-level source combined with package-level download_source or resolver_dist.
• Name both conflicting field paths in the error.
• Keep source-only and legacy-only configurations valid.
• Add focused tests for both cross-level directions, including an explicitly written pre_built: false.