packages CLI: install and update Git Package Sources #299

This was generated by AI during triage.

Agent Brief

Category: enhancement
Summary: Add third-party Git installation and revision-aware updates.

Current behavior:
The Package CLI has no Git Package Source or update operation.

Desired behavior:
A Git URL identifies a repository whose root is one Package. packages add <git-url> clones it, validates it through the same installation contract as a local Package, and records the exact commit. packages update [<name>] operates only on Git-backed Packages. It refuses dirty working copies, advances from the recorded source, validates and preflights the result, then records the new exact commit. Failures retain enough state to restore or retry the prior revision.

Key interfaces:

• lyracore packages add <git-url>
• lyracore packages update [<name>]
• Git Package Source and exact revision in the provenance stamp

Acceptance criteria:

• A repository-root Package installs from a Git URL and records its exact commit.
• Update targets one named Package or every Git-backed Package when no name is given.
• Local-folder and Official Package Sources are not treated as ordinary Git updates.
• Dirty Package checkouts are refused without discarding changes.
• Validation or preflight failure reports the old and candidate revisions and leaves a recoverable state.
• Neither add nor update publishes or synchronizes a client.

Out of scope:

• Multi-Package layout in a third-party repository
• Official bare-name lookup