feat: system-agnostic package manager — 5 inits, 2 bootloaders, parallel scheduler

Complete rewrite of kappa from a sequential build tool into a
system-agnostic package manager with runtime init switching.

Core additions:
- 5 init system backends: systemd, openrc, s6, runit, dinit
  (service file generation, enable/disable, init_paths)
- 2 bootloader backends: grub, limine (config generation, fallback entries)
- Parallel scheduler with worker pool, depth-based priority (Beta/Alpha/Zeta),
  atomic claiming, dependency tracking, deduplication, and failure propagation
- Init-switch impact analysis: only rebuild packages using ${enabledinit}
- Init-agnostic service definitions: flat NamedService blocks replace
  per-init nesting
- Package conflicts: mutual incompatibility detection in resolver
- System groups: init-agnostic group creation in DSL
- Init-agnostic hostname/timezone: direct /etc/hostname and /etc/localtime writes
- Source tarball caching at /kappa/cache/ with atomic write-then-rename
- Package recipe caching with remote fetching and version comparison
- remotes = [...] block in system config for package repositories
- Auto-fetch: rebuild resolves missing packages from remotes
- uninstall phase in package definitions
- ${enabledinit} eval variable for init-conditional builds
- Shared util module (to_lower, shell_escape)
- 54 integration tests across two shell test suites
- Comprehensive README and CONTRIBUTING guide

Bug fixes from review:
- CRITICAL: Replace std::system() with fork+execvp (command injection)
- CRITICAL: Fix scheduler deadlock on successful completion
- CRITICAL: Fix rebuild init/kernel/bootloader change detection
- HIGH: Fix path traversal via unsanitized package names in cache
- HIGH: Fix TOCTOU race in cache write with atomic rename
- HIGH: Fix formatter dropping remotes/imports blocks
- HIGH: Fix formatter stripping empty-string assert values
- HIGH: Fix formatter non-idempotent output (sorted key iteration)
- HIGH: Populate ${enabledinit} from boot.init in BuildStep
- MEDIUM: Fix data race on non-atomic scheduler stop flag
- MEDIUM: Fix compute_depths() traversal direction
- MEDIUM: Add runit to doctor supported-init warning
- MEDIUM: Extract to_lower/shell_escape to shared kappa::util
- MEDIUM: Consolidate generator declarations in headers

src/rebuild/rebuild.cpp

@@ -1,6 +1,8 @@
 #include "kappa/rebuild/rebuild.hpp"
 #include "kappa/install/install.hpp"
+#include "kappa/service/types.hpp"
 
+#include <iostream>
 #include <set>
 
 namespace kappa::rebuild {
@@ -43,13 +45,17 @@ ChangeSet compute_changes(const dsl::SystemConfig& cfg) {
     }
 
     for (auto& e : installed) {
-        if (e.name == "kernel" && e.hash != cfg.boot.kernel) {
+        // Compare the installed version (which stores the identifier string
+        // for virtual packages like init/kernel/bootloader) against the
+        // config value.  These virtual entries have their identity in the
+        // version field, not the hash field.
+        if (e.name == "kernel" && e.version != cfg.boot.kernel) {
             cs.kernel_changed = true;
         }
-        if (e.name == "init" && e.hash != cfg.boot.init) {
+        if (e.name == "init" && e.version != cfg.boot.init) {
             cs.init_changed = true;
         }
-        if (e.name == "bootloader" && e.hash != cfg.boot.bootloader) {
+        if (e.name == "bootloader" && e.version != cfg.boot.bootloader) {
             cs.bootloader_changed = true;
         }
     }
@@ -61,4 +67,57 @@ ChangeSet compute_changes(const dsl::SystemConfig& cfg) {
     return cs;
 }
 
+InitImpact compute_init_impact(const dsl::SystemConfig& cfg,
+                               const resolve::Registry& registry) {
+    InitImpact impact;
+    auto init_system = cfg.boot.init;
+
+    // Only compute impact if an init system is actually configured
+    if (init_system.empty()) { return impact; }
+
+    auto is = kappa::service::parse_init_system(init_system);
+    if (is == kappa::service::InitSystem::Unknown) {
+        std::cerr << "warning: unknown init system '" << init_system
+                  << "' — cannot compute init impact\n";
+        return impact;
+    }
+
+    // For each package in the config that has a matching registry entry...
+    for (auto& pref : cfg.packages) {
+        auto rit = registry.find(pref.name);
+        if (rit == registry.end()) { continue; }
+
+        auto& pkg = rit->second;
+
+        // No services — nothing to do
+        if (pkg.services.empty()) {
+            impact.skipped.push_back(pkg.name);
+            continue;
+        }
+
+        // Check if build scripts reference ${enabledinit}
+        bool uses_enabledinit = false;
+        auto check_phase = [&](const dsl::Phase& phase) {
+            for (auto& cmd : phase.commands) {
+                if (cmd.find("${enabledinit}") != std::string::npos) {
+                    uses_enabledinit = true;
+                    return;
+                }
+            }
+        };
+        check_phase(pkg.prepare);
+        if (!uses_enabledinit) check_phase(pkg.build);
+        if (!uses_enabledinit) check_phase(pkg.check);
+        if (!uses_enabledinit) check_phase(pkg.install);
+
+        if (uses_enabledinit) {
+            impact.service_rebuild.push_back(pkg.name);
+        } else {
+            impact.service_only.push_back(pkg.name);
+        }
+    }
+
+    return impact;
+}
+
 } // namespace kappa::rebuild