fix(build): point generated package.lua urls at local build cache via file:// repo

.omo/notepads/tofu-core/learnings.md

@@ -1437,3 +1437,21 @@ The sandbox test (test 2) creates a sentinel file, serves an index containing `o
   (1..1024 for jobs), warn to stderr, and fall back to the default. This
   mirrors the existing `parseIntOr` warning pattern already used for env
   vars.
+
+## task-14 — --repo must point at local build cache, not remote ZUUR
+
+- zeta-makepkg's `--repo <url>` is baked VERBATIM into every generated
+  package.lua as `url = <repo>/<name>-<ver>.tar.gz`. A hardcoded remote
+  URL therefore makes `zeta -LocalProvide` fetch from the remote
+  fileserver (404) instead of the local build cache.
+- Fix: pass `--repo file://<outputDir>` (the build cache dir). Generated
+  manifests then carry `url = "file://<outputDir>/packages/<name>/<name>-<ver>.tar.gz"`
+  — exactly where the tarball lives. Zeta's fetch.get handles `file://`
+  via plain file copy (references/ZETA/lib/fetch.lua:108-110).
+- The manifest should only carry a real remote repo URL when the user
+  deliberately publishes to ZUUR — at which point the manifest is
+  regenerated with the real URL. Local builds always point at the cache.
+- install.d's ZETA_REPO is DIFFERENT: that's the remote binary pool used
+  to resolve BINARY deps, and it is correct as-is. Do not confuse the two.
+- Smoketest fake zeta-makepkg parses only `--output`, so the repo URL
+  value is irrelevant to it — changing --repo doesn't break the e2e.