fix: Phase 3+4 review — deterministic hash, EINTR, env restore, installer wiring

- std::hash→FNV-1a (deterministic across runs, null-byte-separated)
- waitpid EINTR retry loop (prevents zombie processes under signals)
- setenv save/restore between builds (prevents cross-package env leaks)
- install::install() wired into kappa build CLI (store + DB + generations)
- Zero-padded generation filenames (gen-0001, lexicographic sort correct)
- Hardcoded paths fixed: /tmp/kappa-build→paths::temp_dir()/build
- Hardcoded destdir: /kappa/temp/destdir→paths::temp_dir()/destdir
- ensure_directories() called at main() startup
- build subcommand: -j N, --root wired end-to-end

src/fetch/fetch.cpp

@@ -123,14 +123,14 @@ FetchResult fetch(const dsl::PackageDef& pkg) {
     }
 
     auto dest_name = pkg.name + "-" + pkg.version;
-    auto dest_file = fs::path(paths::temp_dir) / (dest_name + "." + ext);
-    result.work_dir = fs::path(paths::temp_dir) / dest_name;
+    auto dest_file = fs::path(paths::temp_dir()) / (dest_name + "." + ext);
+    result.work_dir = fs::path(paths::temp_dir()) / dest_name;
 
     if (ext == "git") {
         int rc = exec_cmd({"git", "clone", url, result.work_dir.string()});
         if (rc != 0) { result.error = "git clone failed"; return result; }
     } else {
-        fs::create_directories(paths::temp_dir);
+        fs::create_directories(paths::temp_dir());
         int rc = exec_cmd({"curl", "-L", "-o", dest_file.string(), url});
         if (rc != 0) { result.error = "download failed"; return result; }
 
@@ -162,7 +162,7 @@ FetchResult fetch(const dsl::PackageDef& pkg) {
             if (rc2 != 0) { result.error = "extraction failed"; return result; }
         } else {
             int rc2 = exec_cmd({"tar", "xf", dest_file.string(),
-                               "-C", paths::temp_dir.string(),
+                               "-C", paths::temp_dir().string(),
                                "--no-same-owner", "--no-same-permissions"});
             if (rc2 != 0) { result.error = "extraction failed"; return result; }
         }
@@ -174,7 +174,7 @@ FetchResult fetch(const dsl::PackageDef& pkg) {
         auto patch_path = patch.url;
         auto patch_file = patch_path;
         if (patch_path.starts_with("http")) {
-            auto local = fs::path(paths::temp_dir)
+            auto local = fs::path(paths::temp_dir())
                        / fs::path(patch_path).filename();
             int rc = exec_cmd({"curl", "-L", "-o", local.string(),
                               patch_path});