[NFR]: `bin/crest` loads the autoloader of the install that runs it

[niden]

Summary

bin/crest loads the package's own vendor/autoload.php first. It must load the autoloader of the install that runs it. The hand-off loop guard must compare vendor folders, not package paths. A follow-up of #27.

Why

• A path repository of a crest dev checkout brings that checkout's vendor/ (copy mode) or points to it (symlinks). That crest then uses the dev checkout's autoloader.
• With symlinks, the global crest and the project crest have the same real path. The loop guard sees one crest, and there is no hand-off.
• A Packagist install has no vendor/ in the package, so normal users do not see this. Contributors and local tests do.

Scope

• bin/crest tries, in this order:

1. $GLOBALS['_composer_autoload_path'] (composer 2.2+ sets it in the vendor/bin proxy),
2. dirname(__DIR__, 3) . '/autoload.php' (crest installed as a dependency),
3. dirname(__DIR__) . '/vendor/autoload.php' (the dev checkout, last).

• HandOff::isSelf() compares the vendor folder of the running crest with
  <root>/vendor.
• Tests: a BinaryTest case with a fake proxy that sets the variable, and a
  HandOffTest case for the loop guard.

Done when

A symlinked path repository gives a working hand-off, and the gates are clean.

Related: #27.