feat: wire rebuild pipeline (scheduler \u2192 build \u2192 install \u2192 services \u2192 bootloader)

The rebuild subcommand now executes the full pipeline:
- build_registry() -> resolve() -> sched::run()
- install::install() for each built package
- service::install_service() for enabled services
- boot::install_bootloader_config() for bootloader config
- system::write_hostname() / write_timezone() for system activation

Added --dry-run flag for report-only behavior (backward compat with
test suite). Added -w flag for worker parallelism and --dry-run to help.
Fixed .gitignore: 'kappa' -> '/kappa' (was matching include/kappa/,
preventing header files from being tracked since initial commit).
This commit also adds all previously-gitignored header files.

test-init-switch.sh

@@ -235,7 +235,7 @@ config_template "s6" > /tmp/kappa-test-rebuild-s6.kap
 # The packages list includes "s6" which isn't in the installed DB,
 # so rebuild correctly shows it as a new package to build.
 check "rebuild detects new init package" \
-    "$KAPPA_BIN rebuild /tmp/kappa-test-rebuild-s6.kap 2>&1" \
+    "$KAPPA_BIN rebuild --dry-run /tmp/kappa-test-rebuild-s6.kap 2>&1" \
     'packages to rebuild'
 
 # Now test switching FROM s6 TO systemd
@@ -244,7 +244,7 @@ config_template "systemd" > /tmp/kappa-test-rebuild-systemd.kap
 # The rebuild should detect init_changed
 # Note: this requires the installed DB to have the old init hash
 check "rebuild detects init change" \
-    "$KAPPA_BIN rebuild /tmp/kappa-test-rebuild-systemd.kap 2>&1" \
+    "$KAPPA_BIN rebuild --dry-run /tmp/kappa-test-rebuild-systemd.kap 2>&1" \
     'packages to rebuild'
 
 echo ""