feat: lockfile v2, index pin/unpin CLI, fetcher routing for custom indices

[Sunrisepeak]

Summary

Builds on #39 to complete the [indices] feature with three components:

• Lockfile v2: [indices.<name>] sections lock index commit SHA + namespace field per package entry, with automatic v1→v2 migration
• CLI commands: mcpp index pin <name> [<rev>] and mcpp index unpin <name> for hard-locking indices in mcpp.toml
• Fetcher routing: dependency resolution routes through local path index, project-level .mcpp/data/, or global xlings home based on the index type

Changes

File	What
src/pm/lock_io.cppm	LockedIndex struct, v2 schema (indices sections + namespace), v1→v2 auto-migration, updated serialize/deserialize
src/lockfile.cppm	Re-export LockedIndex
src/cli.cppm	cmd_index_pin (text-based mcpp.toml editing, short→long form conversion), cmd_index_unpin (rev field removal), enhanced cmd_index_update (project-level refresh), fetcher routing in prepare_build via findIndexForNs helper, v2 lockfile write with namespace + index entries
src/pm/package_fetcher.cppm	read_xpkg_lua_from_project_data() for .mcpp/data/ scanning, install_path_from_project_data() for project-level xpkgs
tests/e2e/43_indices_lockfile.sh	v2 lockfile structure verification, pin/unpin command testing, index list regression check

Lockfile v2 format

version = 2

[indices."acme"]
url = "git@gitlab.example.com:platform/mcpp-index.git"
rev = "abc123def0123456789abcdef0123456789abcd"

[package."gtest"]
namespace = "mcpplibs"
version = "1.15.2"
source = "index+mcpplibs@sha:<from-xlings>"
hash = "sha256:..."

Fetcher routing logic

dep (ns, name, version)
  → findIndexForNs(ns) → IndexSpec?
    → is_local()    → read_xpkg_lua_from_path(spec.path, name)
    → is custom git → install_path_from_project_data(.mcpp/data/)
    → default       → global xlings home (unchanged)

Test plan

• mcpp build compiles successfully
• E2E 43_indices_lockfile.sh passes (v2 structure, pin/unpin, index list)
• E2E 42_custom_local_index.sh passes (no regression)
• E2E 01_help_and_version.sh passes (no regression)