feat: portability, correctness, and quality improvements for v0.2

Portability (Linux distro-agnostic):
- Remove hardcoded Clang compiler enforcement; GCC now builds
- Add find_package(Threads REQUIRED) for older glibc
- Add cmake install() target
- FHS 3.0 default root: /kappa -> /usr/local/kappa
- fs::path operator/ for all init/bootloader paths (fixes prefix fragility)
- Multi-distro zoneinfo search (FHS, NixOS, Guix, alt)
- Portable tar extraction (drop GNU-only --no-same-permissions)
- Runit enable/disable commands now prefix-aware
- --root CLI flag before/after subcommand, lazy directory creation
- Shebang constants de-duplicated to types.hpp

Correctness (race conditions, UB, corruption):
- Fix CWD race in scheduler: per-child chdir() instead of process-global
- Fix UB const_cast in exec_cmd/exec_capture: mutable argv buffers
- Fix non-atomic installed DB writes: tmp+rename pattern
- Fix read_file() no longer calls exit(1), throws instead
- Fix silent catch(...) parse errors now print diagnostics
- Fix rebuild false positives with config_hash change detection
- Fix s6 disable_cmd copy-paste bug (was identical to enable)
- Fix runit enable_cmd incomplete, disable_cmd wrong target
- Fix dinit env vars: functional env-file + companion .env

Quality:
- Add -Wall -Wextra -Wpedantic to CMake, fix 2 pre-existing warnings
- Move parse_int from error.hpp to parse_util.hpp
- Fix hash verification guard checks all three hash types
- Check patch return code in fetch.cpp
- Add explicit system_dir creation in ensure_directories()
- Add resolve to needs_dirs for build_registry() consistency
- Update stale /kappa path references in examples
- Remove inaccurate -Werror claim in CONTRIBUTING.md
- Add build-gcc/ and agent dirs to .gitignore
- Suppress clang-tidy portability-avoid-pragma-once
- Fix .gitignore /kappa pattern (was matching include/kappa/)
- Delete stale vcpkg_installed/ directory

54/54 tests pass. Builds on Clang and GCC with 0 warnings.

src/service/install.cpp

@@ -110,7 +110,7 @@ ServiceInstallResult install_service(InitSystem is,
                 return {false, {},
                         std::format("Failed to write {}", run_path.string())};
             }
-            out << "#!/bin/execlineb -P\n";
+            out << s6_execline_shebang;
             out << "# Generated by kappa — do not edit manually\n";
             out << std::format("# s6 service: {}\n", spec.name);
             if (!spec.working_dir.empty()) {
@@ -196,6 +196,17 @@ ServiceInstallResult install_service(InitSystem is,
         out << content;
     }
 
+    // Dinit: also write companion .env file
+    if (is == InitSystem::Dinit && !spec.env.empty()) {
+        fs::path env_path = fs::path(paths.service_dir) / std::format("{}.env", spec.name);
+        std::ofstream env_out(env_path);
+        if (env_out) {
+            for (const auto& [key, value] : spec.env) {
+                env_out << key << "=" << value << "\n";
+            }
+        }
+    }
+
     return {true, file_path.string(), {}};
 }