feat: add repo planning/binary repo support and Meson build integration

- add repos.toml source/binary repo configuration with arch overrides and priorities
- add dependency planner/execution plan flow with interactive provider selection and --yes support
- expand binary repo DB metadata (sha512, dependencies, file lists) and repo owns/search helpers
- add rootfs-scoped fd locking and minisign detached signing/verification helpers
- add Meson build/test support for the project with builddir-local CARGO_HOME/CARGO_TARGET_DIR
- install contrib example configs into sysconfdir (/etc/depot.d layout) via Meson
- improve builder env handling (sanitized PATH, tool env passthrough, CXXFLAGS support)
- support += appends in package specs and add build.flags.cxxflags parsing
- prompt for git credentials when private repo auth is required
- update docs/examples and dependency setup (system libs, zstdmt, tempfile pin)

src/db/mod.rs

@@ -751,3 +751,33 @@ pub fn get_package_version(db_path: &Path, name: &str) -> Result<Option<String>>
         .ok();
     Ok(version)
 }
+
+/// Find the installed package that owns a filesystem path from the local DB.
+pub fn owns_path(db_path: &Path, path: &Path) -> Result<Option<String>> {
+    if !db_path.exists() {
+        return Ok(None);
+    }
+
+    let normalized = path
+        .to_string_lossy()
+        .trim_start_matches('/')
+        .trim_start_matches("./")
+        .to_string();
+    if normalized.is_empty() {
+        return Ok(None);
+    }
+
+    let conn = Connection::open(db_path)?;
+    let owner = conn
+        .query_row(
+            "SELECT p.name
+             FROM files f
+             JOIN packages p ON p.id = f.package_id
+             WHERE f.path = ?1
+             LIMIT 1",
+            params![normalized],
+            |row| row.get(0),
+        )
+        .ok();
+    Ok(owner)
+}