feat: system-agnostic package manager — 5 inits, 2 bootloaders, parallel scheduler

Complete rewrite of kappa from a sequential build tool into a
system-agnostic package manager with runtime init switching.

Core additions:
- 5 init system backends: systemd, openrc, s6, runit, dinit
  (service file generation, enable/disable, init_paths)
- 2 bootloader backends: grub, limine (config generation, fallback entries)
- Parallel scheduler with worker pool, depth-based priority (Beta/Alpha/Zeta),
  atomic claiming, dependency tracking, deduplication, and failure propagation
- Init-switch impact analysis: only rebuild packages using ${enabledinit}
- Init-agnostic service definitions: flat NamedService blocks replace
  per-init nesting
- Package conflicts: mutual incompatibility detection in resolver
- System groups: init-agnostic group creation in DSL
- Init-agnostic hostname/timezone: direct /etc/hostname and /etc/localtime writes
- Source tarball caching at /kappa/cache/ with atomic write-then-rename
- Package recipe caching with remote fetching and version comparison
- remotes = [...] block in system config for package repositories
- Auto-fetch: rebuild resolves missing packages from remotes
- uninstall phase in package definitions
- ${enabledinit} eval variable for init-conditional builds
- Shared util module (to_lower, shell_escape)
- 54 integration tests across two shell test suites
- Comprehensive README and CONTRIBUTING guide

Bug fixes from review:
- CRITICAL: Replace std::system() with fork+execvp (command injection)
- CRITICAL: Fix scheduler deadlock on successful completion
- CRITICAL: Fix rebuild init/kernel/bootloader change detection
- HIGH: Fix path traversal via unsanitized package names in cache
- HIGH: Fix TOCTOU race in cache write with atomic rename
- HIGH: Fix formatter dropping remotes/imports blocks
- HIGH: Fix formatter stripping empty-string assert values
- HIGH: Fix formatter non-idempotent output (sorted key iteration)
- HIGH: Populate ${enabledinit} from boot.init in BuildStep
- MEDIUM: Fix data race on non-atomic scheduler stop flag
- MEDIUM: Fix compute_depths() traversal direction
- MEDIUM: Add runit to doctor supported-init warning
- MEDIUM: Extract to_lower/shell_escape to shared kappa::util
- MEDIUM: Consolidate generator declarations in headers

src/fetch/recipe.cpp

@@ -0,0 +1,128 @@
+#include "kappa/fetch/recipe.hpp"
+
+#include "kappa/dsl/parser.hpp"
+#include "kappa/dsl/system.hpp"
+#include "kappa/paths.hpp"
+
+#include <sys/wait.h>
+#include <unistd.h>
+#include <filesystem>
+#include <format>
+#include <fstream>
+#include <iostream>
+#include <sstream>
+#include <string>
+#include <vector>
+
+namespace kappa::fetch {
+
+namespace {
+int exec_curl(const std::string& output_path, const std::string& url) {
+    pid_t pid = fork();
+    if (pid == 0) {
+        execlp("curl", "curl", "-Lsf", "-o", output_path.c_str(), url.c_str(), nullptr);
+        _exit(127);
+    }
+    if (pid < 0) return -1;
+    int status = 0;
+    while (waitpid(pid, &status, 0) == -1 && errno == EINTR) {}
+    return WIFEXITED(status) ? WEXITSTATUS(status) : -1;
+}
+} // namespace
+
+RecipeResult fetch_recipe(const std::string& name,
+                          const std::vector<std::string>& remotes) {
+    RecipeResult result;
+
+    // Check cached version first
+    auto cache_path = paths::packages_dir() / (name + ".kap");
+    std::string cached_version;
+    if (std::filesystem::exists(cache_path)) {
+        std::ifstream in(cache_path);
+        if (in) {
+            std::ostringstream buf;
+            buf << in.rdbuf();
+            try {
+                auto pkg = dsl::parse(buf.str());
+                cached_version = pkg.version;
+            } catch (...) {
+                // Corrupt cache — will re-download
+            }
+        }
+    }
+
+    // Try each remote
+    std::string best_content;
+    std::string best_version;
+    std::string best_url;
+
+    for (auto& remote : remotes) {
+        auto url = remote;
+        if (!url.empty() && url.back() != '/') url += '/';
+        url += name + ".kap";
+
+        // Download to temp
+        auto temp_path = paths::temp_dir() / (name + ".kap.tmp");
+        int rc = exec_curl(temp_path.string(), url);
+        if (rc != 0) continue;
+
+        // Parse downloaded file
+        std::ifstream in(temp_path);
+        if (!in) { std::filesystem::remove(temp_path); continue; }
+        std::ostringstream buf;
+        buf << in.rdbuf();
+        in.close();
+
+        std::string remote_version;
+        try {
+            auto pkg = dsl::parse(buf.str());
+            remote_version = pkg.version;
+        } catch (...) {
+            std::filesystem::remove(temp_path);
+            continue;
+        }
+
+        // Compare versions — keep the best (highest)
+        // Simple string comparison for now; semver later
+        if (remote_version > best_version) {
+            best_version = remote_version;
+            best_content = buf.str();
+            best_url = url;
+        }
+
+        std::filesystem::remove(temp_path);
+    }
+
+    if (best_content.empty()) {
+        if (!cached_version.empty()) {
+            // No remote available but have cache
+            result.ok = true;
+            result.path = cache_path.string();
+            result.version = cached_version;
+            result.updated = false;
+            return result;
+        }
+        result.error = "package '" + name + "' not found in any remote";
+        return result;
+    }
+
+    // Update cache if remote is newer
+    if (best_version > cached_version || cached_version.empty()) {
+        std::error_code ec;
+        std::filesystem::create_directories(paths::packages_dir(), ec);
+        std::ofstream out(cache_path);
+        if (!out) {
+            result.error = "cannot write to cache";
+            return result;
+        }
+        out << best_content;
+        result.updated = true;
+    }
+
+    result.ok = true;
+    result.path = cache_path.string();
+    result.version = best_version;
+    return result;
+}
+
+} // namespace kappa::fetch