feat: portability, correctness, and quality improvements for v0.2

Portability (Linux distro-agnostic):
- Remove hardcoded Clang compiler enforcement; GCC now builds
- Add find_package(Threads REQUIRED) for older glibc
- Add cmake install() target
- FHS 3.0 default root: /kappa -> /usr/local/kappa
- fs::path operator/ for all init/bootloader paths (fixes prefix fragility)
- Multi-distro zoneinfo search (FHS, NixOS, Guix, alt)
- Portable tar extraction (drop GNU-only --no-same-permissions)
- Runit enable/disable commands now prefix-aware
- --root CLI flag before/after subcommand, lazy directory creation
- Shebang constants de-duplicated to types.hpp

Correctness (race conditions, UB, corruption):
- Fix CWD race in scheduler: per-child chdir() instead of process-global
- Fix UB const_cast in exec_cmd/exec_capture: mutable argv buffers
- Fix non-atomic installed DB writes: tmp+rename pattern
- Fix read_file() no longer calls exit(1), throws instead
- Fix silent catch(...) parse errors now print diagnostics
- Fix rebuild false positives with config_hash change detection
- Fix s6 disable_cmd copy-paste bug (was identical to enable)
- Fix runit enable_cmd incomplete, disable_cmd wrong target
- Fix dinit env vars: functional env-file + companion .env

Quality:
- Add -Wall -Wextra -Wpedantic to CMake, fix 2 pre-existing warnings
- Move parse_int from error.hpp to parse_util.hpp
- Fix hash verification guard checks all three hash types
- Check patch return code in fetch.cpp
- Add explicit system_dir creation in ensure_directories()
- Add resolve to needs_dirs for build_registry() consistency
- Update stale /kappa path references in examples
- Remove inaccurate -Werror claim in CONTRIBUTING.md
- Add build-gcc/ and agent dirs to .gitignore
- Suppress clang-tidy portability-avoid-pragma-once
- Fix .gitignore /kappa pattern (was matching include/kappa/)
- Delete stale vcpkg_installed/ directory

54/54 tests pass. Builds on Clang and GCC with 0 warnings.

src/fetch/fetch.cpp

@@ -19,8 +19,13 @@ using namespace std::string_view_literals;
 
 static int exec_cmd(const std::vector<std::string>& argv) {
     if (argv.empty()) { return -1; }
+    std::vector<std::vector<char>> argv_storage(argv.size());
     std::vector<char*> cargs;
-    for (auto& a : argv) { cargs.push_back(const_cast<char*>(a.c_str())); }
+    for (size_t i = 0; i < argv.size(); ++i) {
+        argv_storage[i].assign(argv[i].begin(), argv[i].end());
+        argv_storage[i].push_back('\0');
+        cargs.push_back(argv_storage[i].data());
+    }
     cargs.push_back(nullptr);
 
     pid_t pid = fork();
@@ -45,8 +50,13 @@ static std::string exec_capture(const std::vector<std::string>& argv) {
         dup2(pipefd[1], STDOUT_FILENO);
         close(pipefd[1]);
 
+        std::vector<std::vector<char>> argv_storage(argv.size());
         std::vector<char*> cargs;
-        for (auto& a : argv) { cargs.push_back(const_cast<char*>(a.c_str())); }
+        for (size_t i = 0; i < argv.size(); ++i) {
+            argv_storage[i].assign(argv[i].begin(), argv[i].end());
+            argv_storage[i].push_back('\0');
+            cargs.push_back(argv_storage[i].data());
+        }
         cargs.push_back(nullptr);
         execvp(cargs[0], cargs.data());
         _exit(127);
@@ -174,7 +184,7 @@ FetchResult fetch(const dsl::PackageDef& pkg) {
                 }
             }
         }
-        if (!verified && !pkg.sha256.empty()) {
+        if (!verified && (!pkg.sha256.empty() || !pkg.sha512.empty() || !pkg.md5.empty())) {
             result.error = "hash verification failed";
             return result;
         }
@@ -186,8 +196,7 @@ FetchResult fetch(const dsl::PackageDef& pkg) {
             if (rc2 != 0) { result.error = "extraction failed"; return result; }
         } else {
             int rc2 = exec_cmd({"tar", "xf", dest_file.string(),
-                               "-C", paths::temp_dir().string(),
-                               "--no-same-owner", "--no-same-permissions"});
+                               "-C", paths::temp_dir().string()});
             if (rc2 != 0) { result.error = "extraction failed"; return result; }
         }
 
@@ -215,8 +224,12 @@ FetchResult fetch(const dsl::PackageDef& pkg) {
             }
         }
 
-        exec_cmd({"patch", "-p" + std::to_string(patch.level),
-                  "-d", result.work_dir.string(), "-i", patch_file});
+        int prc = exec_cmd({"patch", "-p" + std::to_string(patch.level),
+                            "-d", result.work_dir.string(), "-i", patch_file});
+        if (prc != 0) {
+            result.error = "patch failed: " + patch.url;
+            return result;
+        }
     }
 
     return result;