Fix false duplicate detection for multiple declared built-in pluginss (#2799)

## Summary

Fixes #2790, which prevents users from declaring multiple built-in
plugins:

When devbox computed a unique ID (hash) for a plugin like plugin:nodejs
or plugin:python, it tried to use the fully resolved package name. But
for built-in plugins added via include, the package isn’t resolved yet —
so that name is an empty string.

Two different plugins both hashing the empty string = same hash = devbox
thinks they’re duplicates and throws a “circular or duplicate include”
error.

The fix: if the resolved name is empty, use the raw string ("nodejs",
"python") instead. Different raw strings, different hashes, no false
collision. This change should not affect normal package resolution,
since Devbox already enforces that each entry of the packages array is
unique.

## How was it tested?

Added an additional test
(`TestLoadRecursiveMultipleBuiltinPluginIncludes`) which checks that we
can load 2 explicitly declared built-in plugins without issue.

Author: Lagoja

internal/devconfig/config_test.go

@@ -11,6 +11,8 @@ import (
 	"github.com/pkg/errors"
 	"github.com/tailscale/hujson"
 	"go.jetify.com/devbox/internal/devconfig/configfile"
+	"go.jetify.com/devbox/internal/lock"
+	"go.jetify.com/devbox/nix/flake"
 )
 
 func TestOpen(t *testing.T) {
@@ -427,3 +429,43 @@ func TestOSExpandIfPossible(t *testing.T) {
 		})
 	}
 }
+
+// TestLoadRecursiveMultipleBuiltinPluginIncludes is a regression test for
+// DEV-16: two explicit built-in plugin includes must not trigger a false
+// "circular or duplicate include detected" error.
+func TestLoadRecursiveMultipleBuiltinPluginIncludes(t *testing.T) {
+	dir := t.TempDir()
+
+	const jsonContent = `{
+		"packages": [],
+		"include": ["plugin:nodejs", "plugin:python"]
+	}`
+	path := filepath.Join(dir, "devbox.json")
+	if err := os.WriteFile(path, []byte(jsonContent), 0o644); err != nil {
+		t.Fatalf("os.WriteFile error: %v", err)
+	}
+
+	cfg, err := Open(path)
+	if err != nil {
+		t.Fatalf("Open error: %v", err)
+	}
+
+	lockfile, err := lock.GetFile(&testLockProject{dir: dir})
+	if err != nil {
+		t.Fatalf("lock.GetFile error: %v", err)
+	}
+
+	if err := cfg.LoadRecursive(lockfile); err != nil {
+		t.Errorf("LoadRecursive returned unexpected error: %v", err)
+	}
+}
+
+// testLockProject satisfies the unexported lock.devboxProject interface for tests.
+type testLockProject struct {
+	dir string
+}
+
+func (p *testLockProject) ConfigHash() (string, error)                              { return "", nil }
+func (p *testLockProject) Stdenv() flake.Ref                                        { return flake.Ref{} }
+func (p *testLockProject) AllPackageNamesIncludingRemovedTriggerPackages() []string { return nil }
+func (p *testLockProject) ProjectDir() string                                       { return p.dir }

internal/devpkg/package.go

@@ -466,7 +466,7 @@ func (p *Package) Hash() string {
 	}
 
 	if sum == "" {
-		sum = cachehash.Bytes([]byte(p.installable.String()))
+		sum = cachehash.Bytes([]byte(cmp.Or(p.installable.String(), p.Raw)))
 	}
 	return sum[:min(len(sum), 6)]
 }