fix(build): point generated package.lua urls at local build cache via file:// repo

.omo/evidence/task-14-tofu-core.log

@@ -13,3 +13,46 @@ installing package...error: build failedreason: missing dependencytestpkg-2.1 is
 
 === file listing ===
 429 src/tofu/build.d
+
+=== task-14 fix: --repo points at local build cache (file://) ===
+
+ROOT CAUSE:
+- src/tofu/build.d runMakepkg passed a HARDCODED
+  "--repo https://files.spectoria.dev/zuur/binary" to zeta-makepkg.
+- zeta-makepkg baked that URL into every generated package.lua as
+  url = "https://files.spectoria.dev/zuur/binary/<name>-<ver>.tar.gz".
+- zeta -LocalProvide then fetched the tarball from the REMOTE fileserver
+  (404 — doesn't exist) instead of the local build cache where the
+  tarball actually lives at <cache>/built/packages/<name>/.
+
+FIX (verified live):
+- runMakepkg now passes "--repo", "file://" ~ outputDir, so generated
+  manifests carry url = "file://<outputDir>/packages/<name>/<name>-<ver>.tar.gz".
+- Zeta's fetch.get handles file:// via plain file copy
+  (references/ZETA/lib/fetch.lua:108-110). LocalProvide installs work offline.
+- Manually confirmed end-to-end: GNU Make 4.4.1 built + installed + runs.
+
+FILES CHANGED:
+- src/tofu/build.d only (runMakepkg doc + --repo arg + new unittest 14)
+- install.d ZETA_REPO untouched (remote binary pool for BINARY deps — correct)
+- fetch.d, config.d untouched
+
+VERIFICATION:
+- dub build (warningsAsErrors): PASS (Finished, Linking tofu)
+- dub test: 23 modules passed unittests
+- bash tests/e2e/smoketest.sh: 16/16 PASS (fake zeta-makepkg ignores --repo,
+  parses only --output — unaffected)
+- New unittest (14) asserts fake zeta-makepkg receives "--repo file://<outDir>"
+  and that the hardcoded https URL is NOT passed.
+
+EVIDENCE OUTPUT (trimmed):
+dub build 2>&1 | tail -2:
+     Linking tofu
+    Finished To force a rebuild of up-to-date targets, run again with --force
+
+dub test 2>&1 | grep "modules passed":
+    23 modules passed unittests
+
+bash tests/e2e/smoketest.sh 2>&1 | tail -2:
+    PASS: 16 checks passed
+    All checks passed.

.omo/notepads/tofu-core/learnings.md

@@ -1437,3 +1437,21 @@ The sandbox test (test 2) creates a sentinel file, serves an index containing `o
   (1..1024 for jobs), warn to stderr, and fall back to the default. This
   mirrors the existing `parseIntOr` warning pattern already used for env
   vars.
+
+## task-14 — --repo must point at local build cache, not remote ZUUR
+
+- zeta-makepkg's `--repo <url>` is baked VERBATIM into every generated
+  package.lua as `url = <repo>/<name>-<ver>.tar.gz`. A hardcoded remote
+  URL therefore makes `zeta -LocalProvide` fetch from the remote
+  fileserver (404) instead of the local build cache.
+- Fix: pass `--repo file://<outputDir>` (the build cache dir). Generated
+  manifests then carry `url = "file://<outputDir>/packages/<name>/<name>-<ver>.tar.gz"`
+  — exactly where the tarball lives. Zeta's fetch.get handles `file://`
+  via plain file copy (references/ZETA/lib/fetch.lua:108-110).
+- The manifest should only carry a real remote repo URL when the user
+  deliberately publishes to ZUUR — at which point the manifest is
+  regenerated with the real URL. Local builds always point at the cache.
+- install.d's ZETA_REPO is DIFFERENT: that's the remote binary pool used
+  to resolve BINARY deps, and it is correct as-is. Do not confuse the two.
+- Smoketest fake zeta-makepkg parses only `--output`, so the repo URL
+  value is irrelevant to it — changing --repo doesn't break the e2e.