feat: system-agnostic package manager — 5 inits, 2 bootloaders, parallel scheduler

Complete rewrite of kappa from a sequential build tool into a
system-agnostic package manager with runtime init switching.

Core additions:
- 5 init system backends: systemd, openrc, s6, runit, dinit
  (service file generation, enable/disable, init_paths)
- 2 bootloader backends: grub, limine (config generation, fallback entries)
- Parallel scheduler with worker pool, depth-based priority (Beta/Alpha/Zeta),
  atomic claiming, dependency tracking, deduplication, and failure propagation
- Init-switch impact analysis: only rebuild packages using ${enabledinit}
- Init-agnostic service definitions: flat NamedService blocks replace
  per-init nesting
- Package conflicts: mutual incompatibility detection in resolver
- System groups: init-agnostic group creation in DSL
- Init-agnostic hostname/timezone: direct /etc/hostname and /etc/localtime writes
- Source tarball caching at /kappa/cache/ with atomic write-then-rename
- Package recipe caching with remote fetching and version comparison
- remotes = [...] block in system config for package repositories
- Auto-fetch: rebuild resolves missing packages from remotes
- uninstall phase in package definitions
- ${enabledinit} eval variable for init-conditional builds
- Shared util module (to_lower, shell_escape)
- 54 integration tests across two shell test suites
- Comprehensive README and CONTRIBUTING guide

Bug fixes from review:
- CRITICAL: Replace std::system() with fork+execvp (command injection)
- CRITICAL: Fix scheduler deadlock on successful completion
- CRITICAL: Fix rebuild init/kernel/bootloader change detection
- HIGH: Fix path traversal via unsanitized package names in cache
- HIGH: Fix TOCTOU race in cache write with atomic rename
- HIGH: Fix formatter dropping remotes/imports blocks
- HIGH: Fix formatter stripping empty-string assert values
- HIGH: Fix formatter non-idempotent output (sorted key iteration)
- HIGH: Populate ${enabledinit} from boot.init in BuildStep
- MEDIUM: Fix data race on non-atomic scheduler stop flag
- MEDIUM: Fix compute_depths() traversal direction
- MEDIUM: Add runit to doctor supported-init warning
- MEDIUM: Extract to_lower/shell_escape to shared kappa::util
- MEDIUM: Consolidate generator declarations in headers

src/fetch/fetch.cpp

@@ -126,16 +126,37 @@ FetchResult fetch(const dsl::PackageDef& pkg) {
     }
 
     auto dest_name = pkg.name + "-" + pkg.version;
-    auto dest_file = fs::path(paths::temp_dir()) / (dest_name + "." + ext);
+    // Sanitize: replace path separators to prevent traversal
+    for (auto& c : dest_name) {
+        if (c == '/' || c == '\\') c = '_';
+    }
+    auto cache_path = paths::cache_dir() / (dest_name + "." + ext);
+    bool from_cache = false;
+    fs::path dest_file;
+    if (fs::exists(cache_path)) {
+        dest_file = cache_path;
+        from_cache = true;
+    } else {
+        dest_file = fs::path(paths::temp_dir()) / (dest_name + "." + ext);
+    }
     result.work_dir = fs::path(paths::temp_dir()) / dest_name;
 
     if (ext == "git") {
         int rc = exec_cmd({"git", "clone", url, result.work_dir.string()});
         if (rc != 0) { result.error = "git clone failed"; return result; }
     } else {
-        fs::create_directories(paths::temp_dir());
-        int rc = exec_cmd({"curl", "-L", "-o", dest_file.string(), url});
-        if (rc != 0) { result.error = "download failed"; return result; }
+        if (!from_cache) {
+            fs::create_directories(paths::temp_dir());
+            int rc = exec_cmd({"curl", "-L", "-o", dest_file.string(), url});
+            if (rc != 0) { result.error = "download failed"; return result; }
+            std::error_code ec;
+            // Atomic cache write: write to .tmp then rename
+            auto cache_tmp = fs::path(cache_path.string() + ".tmp");
+            fs::copy(dest_file, cache_tmp, ec);
+            if (!ec) {
+                fs::rename(cache_tmp, cache_path, ec);
+            }
+        }
 
         bool verified = false;
         for (auto algo : {"sha512", "sha256", "md5"}) {
@@ -170,7 +191,9 @@ FetchResult fetch(const dsl::PackageDef& pkg) {
             if (rc2 != 0) { result.error = "extraction failed"; return result; }
         }
 
-        fs::remove(dest_file);
+        if (!from_cache) {
+            fs::remove(dest_file);
+        }
     }
 
     for (auto& patch : pkg.patches) {