feat!: publish one file list per package

[QaidVoid]

Needs pkgforge/soar#186 before merging the last commit; see the note at the end.

A package used to describe itself three ways. provides said what names appear on PATH, binaries said where an executable lives when the name alone would not find it, and [source.install] said where files come from but was filtered down to executables on the way into the index. The three overlapped, and binaries silently overrode provides at install time.

They collapse into one field. files carries everything the package takes out of its artifact:

"files": [
  {"source": "fd-v10.4.2-x86_64-unknown-linux-musl/fd",             "to": "bin/fd"},
  {"source": "fd-v10.4.2-x86_64-unknown-linux-musl/fd.1",           "to": "share/man/man1/fd.1"},
  {"source": "fd-v10.4.2-x86_64-unknown-linux-musl/LICENSE-APACHE", "to": "LICENSE"}
]

to is a path inside the package directory, so where a file lands says what it is: bin/ is a command, share/man/ a manual page. An empty source means the artifact is itself the file, which is how a bare binary or an AppImage says so. alias holds package-relative paths resolving to the same file, which is how dunst exposes dunstctl and dunstify.

Recipes may write the list either way. Most read better short:

[source.install]
"fd-v${version}-${arch}-unknown-linux-musl/fd"   = "bin/fd"
"fd-v${version}-${arch}-unknown-linux-musl/fd.1" = "share/man/man1/fd.1"

The long form exists for what that cannot express, an artifact with no interior path and extra names:

[[source.install]]
to         = "bin/dunst"
symlink_as = ["dunstctl", "dunstify"]

validate now rejects an install target that is absolute or escapes the package, and warns when a target starts with a prefix soar links nowhere, so share/mann1/ is caught rather than installing somewhere nothing reads.

The generated index was compared against the previous one at every step: every link name binaries produced is still produced, and none was added.

Merge order. The last commit drops binaries and provides from the index. Current soar reads those and does not read files, so publishing without them makes any client lacking soar#186 fall back to finding an executable by package name. That is right for simple packages and wrong for 7zip, gdu, nnn, usql, the multi-binary ones such as age, clipcat and yazi, and the six that relied on provides. It is deliberately last on the branch so it can be held back.