refactor: stripInternalReplaces — use collect-then-drop pattern

[thumbrise]

multirelease mutates file.Replace during range iteration. Safe today (DropReplace zeroes in-place) but fragile if modfile implementation changes. multimod/applier/applier.go:162-177 already uses the correct two-pass pattern. File: multirelease/transform.go:64