Deps: package fetch settings, and the strictest-wins rule

Part of #227. Proposal: ComlineProject/docs#163, proposals/offline/fetching.md#package-settings.

config.idp settings: explicit fetching (a build never fetches; only comline fetch does) and required hashes.
Precedence: the environment and the root package's settings combine, and the strictest applies. Offline is absolute, and a package only tightens.
A dependency's settings apply only to its own builds, never to its consumers'.
Unknown keys are refused (see core#171 and core#178).

Decided (docs#163):

The package's fetch policy lives in the project's comline.toml, not config.idp. That file is committed, never frozen, and read only for the root package, which gives the precedence rule for free:
```
[fetch]
mode = "explicit"        # "on-demand" (default) or "explicit"
require-hashes = true
```
Machine and organisation config uses the same TOML shape, layered: a system file (/etc/comline/config.toml, %PROGRAMDATA%), a user file (~/.config/comline/config.toml and the platform's equivalents), or a file named by COMLINE_CONFIG. It holds offline, mirrors, cache-dir and trusted-keys.
Environment and flags: COMLINE_OFFLINE=1 and --offline. All layers combine, and the strictest wins.
Parsing comline.toml is the cli's job, so the core side takes the combined policy as input.

Navigation Menu