dedupByTypeSet

Merge the enumerated compile cp with the masking loader's Kotlin jars, deduplicating by the SET OF TYPES each jar defines: the sorted set of its zip .class entry names, hashed. Read from the central directory — no decompression, never the raw bytes, never the filename. That set is exactly what decides whether two jars collide on the K2 index (duplicate classes), so it's the right identity: same type-set ⇒ same library ⇒ keep one. It also folds two builds of one artifact that differ only in packaging (zip timestamps/order), which a byte hash would miss. A null key (no classes, or unreadable) is always kept — it collides with nothing. The two stdlib copies (mcp-kotlin/ staging + our jar-in-jar extraction) share a type-set and collapse to one.

Returns CpEntry, not files: the walk that computes the dedup key yields the overlay's staleness key from the same central directory, so paying for it twice would be the only alternative.