Auditable opt-in source builds for explicitly named roots

[tonythethompson]

Parent

Split from #11, Phase 5.2.

Problem

Some packages cannot be consumed as verified release artifacts, but unrestricted source builds would undermine Numan's artifact-first, auditable model.

Goal

Support source builds only as an explicit, inspectable exception for an explicitly named root package, with immutable provenance and no hidden dependency builds.

Proposed contract

• Source build requires an explicit --source <package> selection for a named root; it is never selected implicitly by resolution, update, or dependency traversal.
• Before cloning/building, Numan presents the repository/ref, resolved commit, build recipe identity, dependency scope, expected output artifact(s), and an explicit consent boundary.
• Lock state records source URL, immutable resolved commit, requested ref, build recipe digest/version, toolchain identity where material, artifact digests, origin = source_build, and selection_reason.
• Dependencies remain artifact-resolved unless independently named by the user for source build.
• Builds occur in isolated temporary work directories and publish only verified declared outputs into Numan's immutable store.
• Failure/cancellation leaves no partially trusted artifact, active state, or lockfile mutation.

Security requirements

• No arbitrary build.nu or repository code executes during inspect/solve/lock; execution begins only after explicit source-build confirmation.
• No floating branch can be treated as reproducible after resolution; lockfiles pin the resolved immutable commit and artifact digest.
• Build logs, command line, environment allow-list, and output provenance are retained in an inspectable record without persisting secrets.

Acceptance criteria

• Fixtures/tests cover consent refusal, clone/build failure, cancellation, immutable-commit pinning, reproducible re-build verification, dependency source-build refusal, tampered outputs, and cleanup.
• numan inspect and lockfile output distinguish registry artifacts from source-built artifacts and show selection reason.
• Real end-to-end coverage builds a small fixture package on Linux, macOS, and Windows.
• Documentation states the threat model, reproducibility limits, cache behavior, and why source builds are never automatic.

Non-goals

• General-purpose sandboxing of untrusted package code.
• Automatically building dependencies from source.
• Replacing release artifacts as the default delivery path.