fix: Phase 3+4 review — deterministic hash, EINTR, env restore, installer wiring

- std::hash→FNV-1a (deterministic across runs, null-byte-separated)
- waitpid EINTR retry loop (prevents zombie processes under signals)
- setenv save/restore between builds (prevents cross-package env leaks)
- install::install() wired into kappa build CLI (store + DB + generations)
- Zero-padded generation filenames (gen-0001, lexicographic sort correct)
- Hardcoded paths fixed: /tmp/kappa-build→paths::temp_dir()/build
- Hardcoded destdir: /kappa/temp/destdir→paths::temp_dir()/destdir
- ensure_directories() called at main() startup
- build subcommand: -j N, --root wired end-to-end

src/dsl/system.cpp

@@ -65,6 +65,9 @@ std::string SysParser::consume_ident() {
         at(TokenType::KwService) ||
         at(TokenType::KwAssert) ||
         at(TokenType::KwImport) ||
+        at(TokenType::KwSha256) ||
+        at(TokenType::KwSha512) ||
+        at(TokenType::KwMd5) ||
         at(TokenType::KwConfig) ||
         at(TokenType::KwFeatures) ||
         at(TokenType::KwVersion) ||
@@ -137,12 +140,16 @@ SystemConfig SysParser::parse() {
                 consume(TokenType::Ident); // ":"
                 a.field = current_.lexeme; advance();
                 if (at(TokenType::Equals)) {
-                    advance(); // first =
+                    advance();
                     if (at(TokenType::Equals)) {
-                        a.op = "=="; advance(); // second =
+                        a.op = "=="; advance();
                     } else {
                         a.op = "=";
                     }
+                } else if (at(TokenType::Ident) && current_.lexeme == "!") {
+                    advance();
+                    consume(TokenType::Equals);
+                    a.op = "!=";
                 } else {
                     a.op = current_.lexeme; advance();
                 }
@@ -195,9 +202,10 @@ void SysParser::parse_system_block(SystemConfig& cfg) {
                 if (at(TokenType::Newline)) { advance(); continue; }
                 auto k = consume_ident();
                 bool soft = false;
-                if (at(TokenType::Ident) && current_.lexeme == "?=") {
-                    soft = true;
+                if (at(TokenType::Ident) && current_.lexeme == "?") {
                     advance();
+                    consume(TokenType::Equals);
+                    soft = true;
                 } else {
                     consume(TokenType::Equals);
                 }