fix: Phase 3+4 review — deterministic hash, EINTR, env restore, installer wiring

- std::hash→FNV-1a (deterministic across runs, null-byte-separated)
- waitpid EINTR retry loop (prevents zombie processes under signals)
- setenv save/restore between builds (prevents cross-package env leaks)
- install::install() wired into kappa build CLI (store + DB + generations)
- Zero-padded generation filenames (gen-0001, lexicographic sort correct)
- Hardcoded paths fixed: /tmp/kappa-build→paths::temp_dir()/build
- Hardcoded destdir: /kappa/temp/destdir→paths::temp_dir()/destdir
- ensure_directories() called at main() startup
- build subcommand: -j N, --root wired end-to-end

src/dsl/lexer.cpp

@@ -20,6 +20,9 @@ static const std::unordered_map<std::string_view, TokenType> keywords = {
     {"patches",  TokenType::KwPatches},
     {"env",      TokenType::KwEnv},
     {"service",  TokenType::KwService},
+    {"sha256",   TokenType::KwSha256},
+    {"sha512",   TokenType::KwSha512},
+    {"md5",      TokenType::KwMd5},
     {"assert",   TokenType::KwAssert},
     {"import",   TokenType::KwImport},
     {"prepare",  TokenType::KwPrepare},
@@ -55,6 +58,9 @@ std::string_view token_name(TokenType type) {
     case TokenType::KwPatches:  return "patches";
     case TokenType::KwEnv:      return "env";
     case TokenType::KwService:  return "service";
+    case TokenType::KwSha256:   return "sha256";
+    case TokenType::KwSha512:   return "sha512";
+    case TokenType::KwMd5:      return "md5";
     case TokenType::KwAssert:   return "assert";
     case TokenType::KwImport:   return "import";
     case TokenType::KwPrepare:  return "prepare";
@@ -145,7 +151,7 @@ Token Lexer::scan_ident() {
     while (pos_ < source_.size()) {
         char c = peek();
         if (std::isspace(static_cast<unsigned char>(c))) { break; }
-        if (c == '"' || c == '[' || c == ']' || c == ',') { break; }
+        if (c == '"' || c == '=' || c == '[' || c == ']' || c == ',') { break; }
         lexeme += advance();
     }