fix: fetcher security — fork+execve, hash verification, tar safety, CLI --help

B1: Replaced all std::system()/popen() with fork+execve — zero shell injection
B2+B3: Added sha256/sha512/md5 fields to PackageDef, parser support, actual hash comparison in verify_hash()
B4: tar --no-same-owner --no-same-permissions, zip uses unzip instead of tar
B5: Patch sha256 verified before application via -i flag (no shell redirect)
B6: kappa fetch --help now prints usage and exits 0
Also: removed dead ternary code, added <cstdlib>/<sys/wait.h>/<unistd.h>

src/main.cpp

@@ -2,6 +2,7 @@
 #include "kappa/config/eval.hpp"
 #include "kappa/dsl/parser.hpp"
 #include "kappa/dsl/system.hpp"
+#include "kappa/fetch/fetch.hpp"
 #include "kappa/resolve/plan.hpp"
 #include "kappa/tools/doctor.hpp"
 #include "kappa/tools/format.hpp"
@@ -30,6 +31,7 @@ Subcommands:
   format        <file>    Format a .kap file to canonical style (printed to stdout)
   doctor        <file>    Check a .kap file for issues and warnings
   resolve       <config>  Resolve a build plan from a system config
+  fetch         <package> Download and verify source for a package
 
 Options:
   -h, --help              Show this help message
@@ -99,7 +101,8 @@ int main(int argc, char* argv[]) {
                          || (subcommand == "validate")
                          || (subcommand == "format")
                          || (subcommand == "doctor")
-                         || (subcommand == "resolve");
+                         || (subcommand == "resolve")
+                         || (subcommand == "fetch");
 
     if (!valid_subcommand) {
         std::cerr << "error: unknown subcommand '" << subcommand << "'\n\n";
@@ -107,9 +110,18 @@ int main(int argc, char* argv[]) {
         return 1;
     }
 
-    // Find the file argument (skip flags)
     const char* file_arg = nullptr;
     for (int i = 2; i < argc; ++i) {
+        if (std::string_view(argv[i]) == "-h"
+            || std::string_view(argv[i]) == "--help") {
+            print_usage();
+            return 0;
+        }
+        if (std::string_view(argv[i]) == "-V"
+            || std::string_view(argv[i]) == "--version") {
+            std::cout << version << '\n';
+            return 0;
+        }
         if (!is_flag(argv[i])) {
             file_arg = argv[i];
             break;
@@ -287,5 +299,21 @@ int main(int argc, char* argv[]) {
         }
     }
 
+    if (subcommand == "fetch") {
+        try {
+            auto pkg = dsl::parse(source);
+            auto result = fetch::fetch(pkg);
+            if (result.ok()) {
+                std::cout << "fetched to " << result.work_dir << "\n";
+                return 0;
+            }
+            std::cerr << "fetch failed: " << result.error << "\n";
+            return 1;
+        } catch (const std::runtime_error& e) {
+            handle_parse_error(file_arg, source, e);
+            return 1;
+        }
+    }
+
     return 1; // unreachable
 }