feat(deps): add explicit build dependencies

[skhaz]

Architectural decision for review

This PR introduces ns.build_dependency as an explicit source/build-time edge instead of extending ns.dependency with bind: false.

The explicit kind is intentional and is the main decision requested from the reviewer:

• Released CLIs permissively ignore unknown dependency fields. A legacy CLI could therefore interpret ns.dependency plus bind: false as a normal runtime dependency and bind backend entries accidentally.
• Released CLIs do not recognize ns.build_dependency, so they cannot silently reinterpret the edge as runtime-bound.
• A module using the new kind must declare a compatible requires_wippy, making the feature requirement explicit and fail-closed in supported CLIs.

Semantics

• Build dependencies use exact semantic versions.
• Resolution, authentication, download, digest verification, installation, and lock persistence are identical to remote runtime dependencies.
• The resolver classifies the selected graph in memory in O(V+E), without a second manifest walk or N+1 I/O.
• The lock records two additive facts:
  • build_only: no runtime path reaches the module.
  • build_dependency: at least one build path reaches the module.
• Runtime reachability wins. A module reached by both runtime and build paths remains runtime-loadable while retaining its verified WAPP as a reproducible build input.
• Build-only modules and local replacements never contribute backend entries, requirements, parameters, embedded runtime resources, or registrations.
• Each source manifest that owns a build edge must independently satisfy requires_wippy.
• Remote build inputs require canonical SHA-256 digests before a generated lock can be written.
• Cached/downloaded artifacts are verified against the pinned digest; server digest drift is rejected.
• With unpacking enabled, build inputs retain the verified WAPP and atomically recreate the extracted directory, preventing a modified directory from diverging from published provenance.

Publishing contract

Published consumers are closed artifacts:

• ns.build_dependency entries are removed before normalization and packaging.
• Exact module/version/SHA-256 tuples are emitted as sorted inert fe_provenance metadata.
• Missing, stale, malformed, corrupted, tracked-replaced, or workspace-replaced build inputs fail publication.
• WAPP v1 remains unchanged.

Compatibility

• Existing ns.dependency behavior is preserved.
• Legacy lockfiles without the additive role fields remain runtime-bound.
• Legacy bare runtime digests remain compatible with equivalent sha256: values.
• No WAPP format or protocol change is introduced.

Scope boundary

This PR is the runtime dependency/update/install/publish foundation. fe-install, fe-check, frontend ABI validation, and Hub server-authoritative redistribution are intentionally handled by follow-up implementation rather than hidden inside the dependency primitive.

Verification

• make test
• go test ./boot/deps/config ./boot/deps/lock ./boot/deps/hub ./cmd/internal/entries ./cmd/wippy/cmd -count=1
• git diff --check 0fe48f50..HEAD
• LSP and pi-lens diagnostics: clean

The implementation went through five independent dual-review rounds. The final round identified workspace replacement loading in the actual publish command; that finding was fixed and the complete harness was rerun. The review iteration cap is now exhausted, so this PR intentionally leaves the final architectural approval to the human reviewer.