feat: system-agnostic package manager — 5 inits, 2 bootloaders, parallel scheduler

Complete rewrite of kappa from a sequential build tool into a
system-agnostic package manager with runtime init switching.

Core additions:
- 5 init system backends: systemd, openrc, s6, runit, dinit
  (service file generation, enable/disable, init_paths)
- 2 bootloader backends: grub, limine (config generation, fallback entries)
- Parallel scheduler with worker pool, depth-based priority (Beta/Alpha/Zeta),
  atomic claiming, dependency tracking, deduplication, and failure propagation
- Init-switch impact analysis: only rebuild packages using ${enabledinit}
- Init-agnostic service definitions: flat NamedService blocks replace
  per-init nesting
- Package conflicts: mutual incompatibility detection in resolver
- System groups: init-agnostic group creation in DSL
- Init-agnostic hostname/timezone: direct /etc/hostname and /etc/localtime writes
- Source tarball caching at /kappa/cache/ with atomic write-then-rename
- Package recipe caching with remote fetching and version comparison
- remotes = [...] block in system config for package repositories
- Auto-fetch: rebuild resolves missing packages from remotes
- uninstall phase in package definitions
- ${enabledinit} eval variable for init-conditional builds
- Shared util module (to_lower, shell_escape)
- 54 integration tests across two shell test suites
- Comprehensive README and CONTRIBUTING guide

Bug fixes from review:
- CRITICAL: Replace std::system() with fork+execvp (command injection)
- CRITICAL: Fix scheduler deadlock on successful completion
- CRITICAL: Fix rebuild init/kernel/bootloader change detection
- HIGH: Fix path traversal via unsanitized package names in cache
- HIGH: Fix TOCTOU race in cache write with atomic rename
- HIGH: Fix formatter dropping remotes/imports blocks
- HIGH: Fix formatter stripping empty-string assert values
- HIGH: Fix formatter non-idempotent output (sorted key iteration)
- HIGH: Populate ${enabledinit} from boot.init in BuildStep
- MEDIUM: Fix data race on non-atomic scheduler stop flag
- MEDIUM: Fix compute_depths() traversal direction
- MEDIUM: Add runit to doctor supported-init warning
- MEDIUM: Extract to_lower/shell_escape to shared kappa::util
- MEDIUM: Consolidate generator declarations in headers

include/kappa/dsl/ast.hpp

@@ -44,12 +44,17 @@ struct EnvEntry {
     bool soft = false;
 };
 
-struct ServiceInit {
+struct NamedService {
+    std::string name = "main";
     std::string exec;
     std::string type;
     std::string user;
     std::vector<int> ports;
     std::unordered_map<std::string, std::string> env;
+    std::string description;
+    std::string after;
+    std::string restart;
+    std::string working_dir;
 };
 
 struct Assertion {
@@ -70,17 +75,19 @@ struct PackageDef {
     std::vector<Dependency> depends;
     std::vector<std::string> provides;
     std::vector<std::string> outputs;
+    std::vector<std::string> conflicts;
     std::unordered_map<std::string, FeatureDef> features;
     std::vector<ConfigFile> config_files;
     std::vector<Patch> patches;
     std::vector<EnvEntry> env_entries;
-    std::unordered_map<std::string, ServiceInit> service;
+    std::vector<NamedService> services;
     std::vector<Assertion> assertions;
     std::unordered_set<std::string> const_keys;
     Phase prepare;
     Phase build;
     Phase check;
     Phase install;
+    Phase uninstall;
 };
 
 } // namespace kappa::dsl

include/kappa/dsl/system.hpp

@@ -39,6 +39,11 @@ struct BootBlock {
     std::unordered_map<std::string, std::string> params;
 };
 
+struct GroupDef {
+    std::string name;
+    int gid = -1;   // -1 = auto-assign
+};
+
 struct UserRef {
     std::string name;
     std::string shell;
@@ -54,11 +59,13 @@ struct ServiceRef {
 
 struct SystemConfig {
     std::vector<std::string> imports;
+    std::vector<std::string> remotes;
     SystemBlock system;
     std::vector<PackageRef> packages;
     std::vector<ServiceRef> services;
     BootBlock boot;
     std::vector<UserRef> users;
+    std::vector<GroupDef> groups;
     std::vector<Assertion> assertions;
 };
 

include/kappa/dsl/token.hpp

@@ -28,6 +28,7 @@ enum class TokenType {
     KwDepends,
     KwProvides,
     KwOutputs,
+    KwConflicts,
     KwFeatures,
     KwConfig,
     KwConst,
@@ -44,6 +45,7 @@ enum class TokenType {
     KwBuild,
     KwCheck,
     KwInstall,
+    KwUninstall,
     KwTrue,
     KwFalse,
 };

include/kappa/paths.hpp

@@ -14,6 +14,8 @@ std::filesystem::path temp_dir();
 std::filesystem::path db_dir();
 std::filesystem::path system_dir();
 std::filesystem::path builds_dir();
+std::filesystem::path cache_dir();
+std::filesystem::path packages_dir();
 
 void ensure_directories();