Define the source-pinned Krad component graph

[keys-i]

Motivation

Establish a compact package graph for the researched compiler, utilities, libc, and runtime libraries without vendoring upstream source trees.

Acceptance criteria

• The root is a private Node workspace that discovers packages/*.
• krad-clang, krad-utils, krad-musl, and krad-libs each record an exact upstream HTTPS repository, full commit revision, source license, and focused paths.
• Component names, paths, revisions, and dependency edges are validated.
• Dependency order is deterministic and rejects missing or cyclic components.
• All packages remain private until real compiler/sysroot artifacts exist.