fix: Phase 3+4 review — deterministic hash, EINTR, env restore, installer wiring

- std::hash→FNV-1a (deterministic across runs, null-byte-separated)
- waitpid EINTR retry loop (prevents zombie processes under signals)
- setenv save/restore between builds (prevents cross-package env leaks)
- install::install() wired into kappa build CLI (store + DB + generations)
- Zero-padded generation filenames (gen-0001, lexicographic sort correct)
- Hardcoded paths fixed: /tmp/kappa-build→paths::temp_dir()/build
- Hardcoded destdir: /kappa/temp/destdir→paths::temp_dir()/destdir
- ensure_directories() called at main() startup
- build subcommand: -j N, --root wired end-to-end

include/kappa/dsl/token.hpp

@@ -37,6 +37,9 @@ enum class TokenType {
     KwService,
     KwAssert,
     KwImport,
+    KwSha256,
+    KwSha512,
+    KwMd5,
     KwPrepare,
     KwBuild,
     KwCheck,

include/kappa/paths.hpp

@@ -1,15 +1,19 @@
 #pragma once
 
 #include <filesystem>
+#include <string>
+#include <string_view>
 
 namespace kappa::paths {
 
-inline const std::filesystem::path root{"/kappa"};
-inline const auto bin_dir    = root / "bin";
-inline const auto temp_dir   = root / "temp";
-inline const auto db_dir     = root / "db";
-inline const auto system_dir = root / "system";
-inline const auto builds_dir = system_dir / "builds";
+void set_root(std::string_view path);
+
+std::filesystem::path root_path();
+std::filesystem::path bin_dir();
+std::filesystem::path temp_dir();
+std::filesystem::path db_dir();
+std::filesystem::path system_dir();
+std::filesystem::path builds_dir();
 
 void ensure_directories();