feat: portability, correctness, and quality improvements for v0.2

Portability (Linux distro-agnostic):
- Remove hardcoded Clang compiler enforcement; GCC now builds
- Add find_package(Threads REQUIRED) for older glibc
- Add cmake install() target
- FHS 3.0 default root: /kappa -> /usr/local/kappa
- fs::path operator/ for all init/bootloader paths (fixes prefix fragility)
- Multi-distro zoneinfo search (FHS, NixOS, Guix, alt)
- Portable tar extraction (drop GNU-only --no-same-permissions)
- Runit enable/disable commands now prefix-aware
- --root CLI flag before/after subcommand, lazy directory creation
- Shebang constants de-duplicated to types.hpp

Correctness (race conditions, UB, corruption):
- Fix CWD race in scheduler: per-child chdir() instead of process-global
- Fix UB const_cast in exec_cmd/exec_capture: mutable argv buffers
- Fix non-atomic installed DB writes: tmp+rename pattern
- Fix read_file() no longer calls exit(1), throws instead
- Fix silent catch(...) parse errors now print diagnostics
- Fix rebuild false positives with config_hash change detection
- Fix s6 disable_cmd copy-paste bug (was identical to enable)
- Fix runit enable_cmd incomplete, disable_cmd wrong target
- Fix dinit env vars: functional env-file + companion .env

Quality:
- Add -Wall -Wextra -Wpedantic to CMake, fix 2 pre-existing warnings
- Move parse_int from error.hpp to parse_util.hpp
- Fix hash verification guard checks all three hash types
- Check patch return code in fetch.cpp
- Add explicit system_dir creation in ensure_directories()
- Add resolve to needs_dirs for build_registry() consistency
- Update stale /kappa path references in examples
- Remove inaccurate -Werror claim in CONTRIBUTING.md
- Add build-gcc/ and agent dirs to .gitignore
- Suppress clang-tidy portability-avoid-pragma-once
- Fix .gitignore /kappa pattern (was matching include/kappa/)
- Delete stale vcpkg_installed/ directory

54/54 tests pass. Builds on Clang and GCC with 0 warnings.

README.md

@@ -76,8 +76,9 @@ kappa rebuild config.kap   # boot.init = "openrc" — only 5 packages actually r
   in your config. Kappa fetches `.kap` files on demand, caches them, and only
   re-fetches when the remote version is newer.
 
-- **Source tarball caching.** Downloaded once, stored at `/kappa/cache/`.
-  Rebuilds don't touch the network unless versions change.
+- **Source tarball caching.** Downloaded once, stored at `$KAPPA_ROOT/cache/`
+  (default: `/usr/local/kappa/cache/`). Rebuilds don't touch the network
+  unless versions change.
 
 - **Conflicts.** `systemd` declares `conflicts = ["eudev", "elogind"]`. The
   resolver catches mutual incompatibility before a build starts.
@@ -103,6 +104,10 @@ kappa rebuild config.kap   # boot.init = "openrc" — only 5 packages actually r
 
 ### Quick start
 
+> **Note for 0.1.x users**: The default store root has moved from `/kappa` to
+> `/usr/local/kappa` (FHS 3.0). Set `KAPPA_ROOT` to your existing `/kappa`
+> directory to keep using the old location.
+
 ```sh
 # Build kappa (needs Clang 17+, CMake 3.20+, C++23)
 cmake -B build -G Ninja -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++