fix(runtime): refuse POST /packages/:id/duplicate on a source that is not a base

fix(runtime): refuse POST /packages/:id/duplicate on a source that is not a base #21344