internal/rosa: read-only access to built-ins

This removes potential footguns caused by mutable builtins without requiring unnecessary clones.

Signed-off-by: Ophestra <cat@gensokyo.uk>

cmd/mbf/internal/pkgserver/api_test.go

@@ -31,7 +31,7 @@ func TestAPIInfo(t *testing.T) {
 	checkPayload(t, resp, struct {
 		Count          int    `json:"count"`
 		HakureiVersion string `json:"hakurei_version"`
-	}{len(rosa.Native().Collect()), info.Version()})
+	}{len(rosa.Collect()), info.Version()})
 }
 
 func TestAPIGet(t *testing.T) {
@@ -92,7 +92,7 @@ func TestAPIGet(t *testing.T) {
 		)
 	})
 
-	count := len(rosa.Native().Collect())
+	count := len(rosa.Collect())
 	t.Run("index", func(t *testing.T) {
 		t.Parallel()
 		checkValidate(