feat: system-agnostic package manager — 5 inits, 2 bootloaders, parallel scheduler

Complete rewrite of kappa from a sequential build tool into a
system-agnostic package manager with runtime init switching.

Core additions:
- 5 init system backends: systemd, openrc, s6, runit, dinit
  (service file generation, enable/disable, init_paths)
- 2 bootloader backends: grub, limine (config generation, fallback entries)
- Parallel scheduler with worker pool, depth-based priority (Beta/Alpha/Zeta),
  atomic claiming, dependency tracking, deduplication, and failure propagation
- Init-switch impact analysis: only rebuild packages using ${enabledinit}
- Init-agnostic service definitions: flat NamedService blocks replace
  per-init nesting
- Package conflicts: mutual incompatibility detection in resolver
- System groups: init-agnostic group creation in DSL
- Init-agnostic hostname/timezone: direct /etc/hostname and /etc/localtime writes
- Source tarball caching at /kappa/cache/ with atomic write-then-rename
- Package recipe caching with remote fetching and version comparison
- remotes = [...] block in system config for package repositories
- Auto-fetch: rebuild resolves missing packages from remotes
- uninstall phase in package definitions
- ${enabledinit} eval variable for init-conditional builds
- Shared util module (to_lower, shell_escape)
- 54 integration tests across two shell test suites
- Comprehensive README and CONTRIBUTING guide

Bug fixes from review:
- CRITICAL: Replace std::system() with fork+execvp (command injection)
- CRITICAL: Fix scheduler deadlock on successful completion
- CRITICAL: Fix rebuild init/kernel/bootloader change detection
- HIGH: Fix path traversal via unsanitized package names in cache
- HIGH: Fix TOCTOU race in cache write with atomic rename
- HIGH: Fix formatter dropping remotes/imports blocks
- HIGH: Fix formatter stripping empty-string assert values
- HIGH: Fix formatter non-idempotent output (sorted key iteration)
- HIGH: Populate ${enabledinit} from boot.init in BuildStep
- MEDIUM: Fix data race on non-atomic scheduler stop flag
- MEDIUM: Fix compute_depths() traversal direction
- MEDIUM: Add runit to doctor supported-init warning
- MEDIUM: Extract to_lower/shell_escape to shared kappa::util
- MEDIUM: Consolidate generator declarations in headers

examples/postgres.kap

@@ -0,0 +1,148 @@
+/*
+ * postgresql — a database server shipping multiple services.
+ *
+ * MULTI-SERVICE PACKAGES
+ * ======================
+ * Packages that install more than one long-running process can declare
+ * multiple named `service` blocks.  Each has its own exec, type, ports,
+ * and lifecycle config.  The system config enables them individually using
+ * dot-notation (see config.kap):
+ *
+ *   services {
+ *       postgresql.main          { enable = true }
+ *       postgresql.checkpointer   { enable = true }
+ *       postgresql.walwriter      { enable = true }
+ *   }
+ *
+ * Omitting the dot selects the service named "main".
+ *
+ *
+ * INIT-CONDITIONAL BUILDS
+ * =======================
+ * The variable ${enabledinit} exposes the configured init system name
+ * (from boot.init in config.kap) during the build phase.  Use shell
+ * conditionals — no DSL if/else needed:
+ *
+ *   build {
+ *       case ${enabledinit} in
+ *           systemd) ./configure --with-systemd --prefix=${prefix} ;;
+ *           openrc)  ./configure --with-openrc  --prefix=${prefix} ;;
+ *           s6|dinit) ./configure --prefix=${prefix} ;;
+ *       esac
+ *       make -j${jobs}
+ *   }
+ *
+ * ${enabledinit} is interpolated to the literal init system name
+ * ("systemd", "openrc", "s6", or "dinit") before the shell executes the
+ * block.  No DSL context-sensitive parsing required.
+ *
+ *
+ * SERVICE TYPE TRANSLATION (for reference)
+ * ========================================
+ *   semantic  │ systemd    │ openrc              │ s6       │ dinit
+ *   ──────────┼────────────┼─────────────────────┼──────────┼──────────
+ *   simple    │ Type=simple│ bg=false            │ longrun   │ process
+ *   forking   │ Type=fork  │ bg=true             │ longrun   │ bgprocess
+ *   notify    │ Type=notify│ bg=true             │ longrun   │ process
+ *   oneshot   │ Type=one   │ bg=false, args=""   │ oneshot   │ scripted
+ *   longrun   │ Type=simple│ bg=true             │ longrun   │ process
+ */
+package "postgresql" {
+    const version = "16.3"
+    const source  = "https://ftp.postgresql.org/pub/source/v${version}/postgresql-${version}.tar.gz"
+    sha256 = "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"
+    license = "PostgreSQL"
+
+    depends = [
+        { name = "readline", version = ">=8" },
+        { name = "zlib",     version = ">=1.2" },
+        { name = "openssl" },
+    ]
+
+    conflicts = []   // mutually exclusive packages (e.g. systemd vs eudev)
+
+    features {
+        ssl    = { enabled = true, flag = "--with-ssl=openssl" }
+        nls    = { enabled = true, flag = "--enable-nls" }
+        systemd = { enabled = false, flag = "--with-systemd" }
+    }
+
+    config {
+        file "etc/postgresql/data/postgresql.conf" mode = "default" {
+            port            = ${cfg.port ? 5432}
+            max_connections = ${cfg.max_conn ? 100}
+            shared_buffers  = ${cfg.shared_buf ? 128MB}
+        }
+    }
+
+    env {
+        CFLAGS  = "-O2"
+        LDFLAGS = "-Wl,--as-needed"
+    }
+
+    // --- services ---------------------------------------------------------
+    // PostgreSQL ships the main server plus several auxiliary processes.
+    // Each runs as a separate service under the init system.
+
+    // Default service (name = "main").  Enabled via: postgresql { enable = true }
+    service main {
+        exec        = "/usr/bin/postgres -D /var/lib/postgresql/data"
+        type        = "forking"        // postmaster daemonises itself
+        user        = "postgres"
+        ports       = [5432]
+        description = "PostgreSQL database server"
+        after       = "network"
+        restart     = "always"
+        working_dir = "/var/lib/postgresql"
+    }
+
+    // Background writer — handles checkpoint I/O.
+    service checkpointer {
+        exec        = "/usr/bin/postgres-checkpointer"
+        type        = "longrun"
+        user        = "postgres"
+        description = "PostgreSQL checkpointer process"
+        restart     = "always"
+    }
+
+    // WAL writer — flushes write-ahead log to disk.
+    service walwriter {
+        exec    = "/usr/bin/postgres-walwriter"
+        type    = "longrun"
+        user    = "postgres"
+        restart = "always"
+    }
+
+    // --- build phases ------------------------------------------------------
+
+    prepare {
+        tar xf postgresql-${version}.tar.gz
+    }
+
+    // init-conditional build: PostgreSQL optionally links against systemd
+    // for socket activation and service notification.  Use ${enabledinit}
+    // to decide configure flags without per-init service blocks.
+    build {
+        case ${enabledinit} in
+            systemd) ./configure --with-systemd --with-ssl=openssl --prefix=${prefix} ;;
+            *)       ./configure --with-ssl=openssl --prefix=${prefix} ;;
+        esac
+        make -j${jobs} world
+    }
+
+    check {
+        make check
+    }
+
+    install {
+        make DESTDIR=${destdir} install-world
+    }
+
+    uninstall {
+        make DESTDIR=${destdir} uninstall-world
+    }
+
+    assert {
+        "data directory must exist" : system.config.data_dir != ""
+    }
+}