Packages that ship unbundled source fail with a dependency cycle

[tomayac]

Managing a package that ships unbundled source rather than pre-bundled dist files fails the build:

cosPlugin({ packages: [/^svelte(\/|$)/] })

[cos] dependency cycle between managed packages:
  svelte/src/legacy/legacy-client.js -> …/reactivity/sources.js -> …/proxy.js
  -> …/dev/tracing.js -> …/runtime.js -> …/reactivity/effects.js
  -> …/dom/operations.js -> …/reactivity/batch.js -> …/reactivity/effects.js

cos-externalise-deps externalizes every import that has an importer, including relative ones, so the unit of chunking is the resolved module, not the package. Svelte's internals import each other circularly (effects.js ↔ batch.js), and a cycle can't be hashed bottom-up.

I looked at it in #52, but decided I don't understand it enough to open a PR, so reporting an Issue instead.