fix: compose extensions when any parent is active

[igrigorik]

The UCP intersection algorithm states:

Remove any capability where extends is set but none of its parent capabilities are in the intersection...
For multi-parent extensions (extends: ["a", "b"]): at least one parent must be present.

The composer required every parent in extends[] to be present in the active response graph. For example, Discount can extend either Cart or Checkout:

{
  "dev.ucp.shopping.discount": [{
    "extends": [
      "dev.ucp.shopping.cart",
      "dev.ucp.shopping.checkout"
    ]
  }]
}

A response containing Checkout + Discount capability, but not Cart, previously failed with:

extension 'dev.ucp.shopping.discount' references unknown parent 'dev.ucp.shopping.cart'

Updated logic allows above / aligns with normative requirement in the UCP spec.

---

Checklist

• Infrastructure: CI/CD, Linters, or build scripts. (Requires DevOps Maintainer approval)
• I have followed the Contributing Guide
• I have updated the documentation (if applicable).
• My changes pass all local linting and formatting checks.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.