feat: system-agnostic package manager — 5 inits, 2 bootloaders, parallel scheduler

Complete rewrite of kappa from a sequential build tool into a
system-agnostic package manager with runtime init switching.

Core additions:
- 5 init system backends: systemd, openrc, s6, runit, dinit
  (service file generation, enable/disable, init_paths)
- 2 bootloader backends: grub, limine (config generation, fallback entries)
- Parallel scheduler with worker pool, depth-based priority (Beta/Alpha/Zeta),
  atomic claiming, dependency tracking, deduplication, and failure propagation
- Init-switch impact analysis: only rebuild packages using ${enabledinit}
- Init-agnostic service definitions: flat NamedService blocks replace
  per-init nesting
- Package conflicts: mutual incompatibility detection in resolver
- System groups: init-agnostic group creation in DSL
- Init-agnostic hostname/timezone: direct /etc/hostname and /etc/localtime writes
- Source tarball caching at /kappa/cache/ with atomic write-then-rename
- Package recipe caching with remote fetching and version comparison
- remotes = [...] block in system config for package repositories
- Auto-fetch: rebuild resolves missing packages from remotes
- uninstall phase in package definitions
- ${enabledinit} eval variable for init-conditional builds
- Shared util module (to_lower, shell_escape)
- 54 integration tests across two shell test suites
- Comprehensive README and CONTRIBUTING guide

Bug fixes from review:
- CRITICAL: Replace std::system() with fork+execvp (command injection)
- CRITICAL: Fix scheduler deadlock on successful completion
- CRITICAL: Fix rebuild init/kernel/bootloader change detection
- HIGH: Fix path traversal via unsanitized package names in cache
- HIGH: Fix TOCTOU race in cache write with atomic rename
- HIGH: Fix formatter dropping remotes/imports blocks
- HIGH: Fix formatter stripping empty-string assert values
- HIGH: Fix formatter non-idempotent output (sorted key iteration)
- HIGH: Populate ${enabledinit} from boot.init in BuildStep
- MEDIUM: Fix data race on non-atomic scheduler stop flag
- MEDIUM: Fix compute_depths() traversal direction
- MEDIUM: Add runit to doctor supported-init warning
- MEDIUM: Extract to_lower/shell_escape to shared kappa::util
- MEDIUM: Consolidate generator declarations in headers

src/system/activate.cpp

@@ -0,0 +1,55 @@
+#include "kappa/system/activate.hpp"
+
+#include <filesystem>
+#include <format>
+#include <fstream>
+
+namespace kappa::system {
+
+ActivateResult write_hostname(const std::string& hostname,
+                              std::string_view prefix) {
+    if (hostname.empty()) {
+        return {false, "hostname is empty"};
+    }
+
+    std::filesystem::path path = std::filesystem::path(prefix) / "etc/hostname";
+    std::error_code ec;
+    std::filesystem::create_directories(path.parent_path(), ec);
+    if (ec) {
+        return {false, std::format("cannot create {}: {}", path.parent_path().string(), ec.message())};
+    }
+
+    std::ofstream out(path);
+    if (!out) {
+        return {false, std::format("cannot write {}", path.string())};
+    }
+    out << hostname << "\n";
+    return {true, {}};
+}
+
+ActivateResult write_timezone(const std::string& timezone,
+                              std::string_view prefix) {
+    if (timezone.empty()) {
+        return {false, "timezone is empty"};
+    }
+
+    // /etc/localtime is a symlink to /usr/share/zoneinfo/{timezone}
+    std::filesystem::path localtime = std::filesystem::path(prefix) / "etc/localtime";
+    std::filesystem::path zoneinfo  = std::filesystem::path(prefix) / "usr/share/zoneinfo" / timezone;
+
+    std::error_code ec;
+    if (!std::filesystem::exists(zoneinfo, ec)) {
+        return {false, std::format("timezone data not found: {}", zoneinfo.string())};
+    }
+
+    std::filesystem::create_directories(localtime.parent_path(), ec);
+    // Remove existing symlink/file if present
+    std::filesystem::remove(localtime, ec);
+    std::filesystem::create_symlink(zoneinfo, localtime, ec);
+    if (ec) {
+        return {false, std::format("cannot create symlink {}: {}", localtime.string(), ec.message())};
+    }
+    return {true, {}};
+}
+
+} // namespace kappa::system