feat: system-agnostic package manager — 5 inits, 2 bootloaders, parallel scheduler

Complete rewrite of kappa from a sequential build tool into a
system-agnostic package manager with runtime init switching.

Core additions:
- 5 init system backends: systemd, openrc, s6, runit, dinit
  (service file generation, enable/disable, init_paths)
- 2 bootloader backends: grub, limine (config generation, fallback entries)
- Parallel scheduler with worker pool, depth-based priority (Beta/Alpha/Zeta),
  atomic claiming, dependency tracking, deduplication, and failure propagation
- Init-switch impact analysis: only rebuild packages using ${enabledinit}
- Init-agnostic service definitions: flat NamedService blocks replace
  per-init nesting
- Package conflicts: mutual incompatibility detection in resolver
- System groups: init-agnostic group creation in DSL
- Init-agnostic hostname/timezone: direct /etc/hostname and /etc/localtime writes
- Source tarball caching at /kappa/cache/ with atomic write-then-rename
- Package recipe caching with remote fetching and version comparison
- remotes = [...] block in system config for package repositories
- Auto-fetch: rebuild resolves missing packages from remotes
- uninstall phase in package definitions
- ${enabledinit} eval variable for init-conditional builds
- Shared util module (to_lower, shell_escape)
- 54 integration tests across two shell test suites
- Comprehensive README and CONTRIBUTING guide

Bug fixes from review:
- CRITICAL: Replace std::system() with fork+execvp (command injection)
- CRITICAL: Fix scheduler deadlock on successful completion
- CRITICAL: Fix rebuild init/kernel/bootloader change detection
- HIGH: Fix path traversal via unsanitized package names in cache
- HIGH: Fix TOCTOU race in cache write with atomic rename
- HIGH: Fix formatter dropping remotes/imports blocks
- HIGH: Fix formatter stripping empty-string assert values
- HIGH: Fix formatter non-idempotent output (sorted key iteration)
- HIGH: Populate ${enabledinit} from boot.init in BuildStep
- MEDIUM: Fix data race on non-atomic scheduler stop flag
- MEDIUM: Fix compute_depths() traversal direction
- MEDIUM: Add runit to doctor supported-init warning
- MEDIUM: Extract to_lower/shell_escape to shared kappa::util
- MEDIUM: Consolidate generator declarations in headers

examples/config.kap

@@ -1,10 +1,55 @@
 /*
  * Kappa system configuration.
  * Lives at /kappa/system/config.kap
+ *
+ * INIT SYSTEM SELECTION
+ * =====================
+ * The `boot.init` field (line ~84) selects which init system manages this
+ * machine.  Valid values (case-insensitive):
+ *
+ *   systemd  —  system and service manager
+ *   openrc   —  OpenRC dependency-based init
+ *   s6       —  s6 supervision suite
+ *   dinit    —  dinit service manager / init system
+ *
+ * The `boot.bootloader` field (line ~122) selects which bootloader config
+ * kappa generates (grub or limine).
+ *
+ * This setting determines:
+ *   1. Which backend generates service files at install time
+ *      (systemd → .service units, openrc → init.d scripts, etc.)
+ *   2. What `${enabledinit}` resolves to during package builds
+ *
+ * Package definitions do NOT specify per-init service blocks.  A package
+ * defines its service once (see examples/foo.kap) and the selected init
+ * system's backend handles the translation.
+ *
+ * SERVICES BLOCK
+ * ==============
+ * The `services` section enables or disables services declared by
+ * installed packages.  Each entry maps to a package's service name:
+ *
+ *   services {
+ *       nginx { enable = true }               // package "nginx", default "main" service
+ *       postgresql.main { enable = true }       // package "postgresql", named service "main"
+ *       postgresql.checkpointer { enable = false }
+ *   }
+ *
+ * For single-service packages, the service name defaults to "main" and
+ * can be omitted.  For multi-service packages, use dot-notation
+ * (pkgname.servicename) to target a specific named service.
+ *
+ * Additional keys in each service block (port, ssl, etc.) are passed as
+ * custom config to the service definition.
  */
 
 imports = []
 
+remotes = [
+    "https://packages.kappa-os.org/stable/",
+    "https://packages.kappa-os.org/contrib/",
+]
+
 assert {
     "efi partition required for UEFI boot" : boot.efi != ""
     "root partition must be set"           : boot.root != ""
@@ -75,11 +120,15 @@ services {
     }
 }
 
+// Select init system — determines which backend generates service files.
+// Valid: systemd, openrc, s6, dinit (case-insensitive).
 boot {
     kernel     = "linux"
     init       = "s6"
     efi        = "/dev/sda2"
     swap       = "/dev/sda3"
+    // Bootloader — generates the appropriate config at install time.
+    // Valid: grub, limine (case-insensitive).
     bootloader = "limine"
     root       = "/dev/sda1"
 }