fix: comprehensive bakery package manager audit and repair

Critical fixes:
- gen-index.sh: emit services, config, optional_system_deps from bakery.toml;
  parse product list from registry TOML instead of hardcoded array; fail loudly
  when bakery.toml is missing (was silently producing empty metadata in prod)
- install.rs: download service units and example configs from dl server at
  install time (were never fetched); check systemctl exit codes (were swallowed);
  save state before file cleanup in remove_package (was inconsistent on error)
- doctor.rs: rewrite dep detection to use `pacman -Q` as primary (no more
  dependency on `which` or pkg-config name mismatches); add optional_system_deps
  support returning (missing, warnings) — warnings print but never block install
- get.sh: fix GitHub fallback URL (was 404 for both latest and versioned
  releases); add SHA-256 checksum verification using published .sha256 file

High priority fixes:
- bakery doctor <unknown-pkg>: exit non-zero (was silently passing)
- bakery update: add --all flag (documented in README but missing from CLI);
  add doctor gate before update (was bypassing dep check)
- bread_deps: now resolved recursively with cycle detection (was ignored)
- manifest.rs: add artifact_urls() helper and optional_system_deps field
- state.rs: atomic save via tmp+rename; cmd_info shows optional_system_deps

Tests: 17 new unit tests across doctor, download, install, state modules;
scripts/test-gen-index.sh fixture test for full pipeline

scripts/get.sh

@@ -1,12 +1,10 @@
 #!/bin/sh
-# Bootstrap script: installs the `bakery` binary.
+# Bootstrap script: downloads and installs the `bakery` binary.
 # Usage: curl https://breadway.dev/get | sh
 # Or:    curl -sSfL https://breadway.dev/get | sh
 set -eu
 
 BAKERY_VERSION="${BAKERY_VERSION:-latest}"
-DL_PRIMARY="https://dl.breadway.dev/bakery/${BAKERY_VERSION}/bakery-x86_64"
-DL_FALLBACK="https://github.com/Breadway/bread-ecosystem/releases/download/${BAKERY_VERSION}/bakery-x86_64"
 BIN_DIR="${BAKERY_BIN_DIR:-$HOME/.local/bin}"
 
 die() { echo "error: $*" >&2; exit 1; }
@@ -15,6 +13,20 @@ die() { echo "error: $*" >&2; exit 1; }
 uname -m | grep -q x86_64 || die "bakery only supports x86_64 (got $(uname -m))"
 uname -s | grep -q Linux  || die "bakery only supports Linux (got $(uname -s))"
 
+# Build download URLs. GitHub's "latest" redirect lives at a different path from
+# versioned releases, so we handle them separately and always prefix tags with 'v'.
+if [ "${BAKERY_VERSION}" = "latest" ]; then
+    DL_PRIMARY="https://dl.breadway.dev/bakery/latest/bakery-x86_64"
+    DL_FALLBACK="https://github.com/Breadway/bread-ecosystem/releases/latest/download/bakery-x86_64"
+    SHA256_URL="https://dl.breadway.dev/bakery/latest/bakery-x86_64.sha256"
+else
+    # Strip a leading 'v' if the caller included it, then add it back consistently.
+    ver="${BAKERY_VERSION#v}"
+    DL_PRIMARY="https://dl.breadway.dev/bakery/${ver}/bakery-x86_64"
+    DL_FALLBACK="https://github.com/Breadway/bread-ecosystem/releases/download/v${ver}/bakery-x86_64"
+    SHA256_URL="https://dl.breadway.dev/bakery/${ver}/bakery-x86_64.sha256"
+fi
+
 # Pick a download tool.
 if command -v curl >/dev/null 2>&1; then
     fetch() { curl -fsSL "$1" -o "$2"; }
@@ -26,13 +38,26 @@ fi
 
 mkdir -p "${BIN_DIR}"
 TMP="$(mktemp)"
-trap 'rm -f "${TMP}"' EXIT
+trap 'rm -f "${TMP}" "${TMP}.sha256"' EXIT
 
 echo "downloading bakery…"
 if fetch "${DL_PRIMARY}" "${TMP}" 2>/dev/null; then
     echo "  from dl.breadway.dev"
+    # Verify checksum when available from primary.
+    if fetch "${SHA256_URL}" "${TMP}.sha256" 2>/dev/null; then
+        expected="$(awk '{print $1}' "${TMP}.sha256")"
+        actual="$(sha256sum "${TMP}" | awk '{print $1}')"
+        if [ "${expected}" != "${actual}" ]; then
+            die "SHA-256 checksum mismatch (expected ${expected}, got ${actual})"
+        fi
+        echo "  checksum verified"
+    else
+        echo "  warning: could not fetch checksum — skipping verification"
+    fi
 elif fetch "${DL_FALLBACK}" "${TMP}" 2>/dev/null; then
     echo "  from GitHub (fallback)"
+    # No .sha256 on the GitHub fallback path; proceed without verification.
+    echo "  warning: checksum not verified for GitHub fallback download"
 else
     die "failed to download bakery from both primary and fallback URLs"
 fi