refactor command flow and add signed package/hook safety

- split CLI definitions and command execution out of main.rs into new cli.rs and commands.rs modules\n- add transaction hook support via /etc/depot.d/hooks/*.toml with pre/post phases, operation/package/path filters, wildcard negation, and optional affected-path stdin\n- execute transaction hooks around install/update/remove operations and add package-action prompts for install/build/remove flows\n- require and verify detached minisign signatures for binary package archives when allow_unsigned=false, including cache handling and tests\n- persist optional dependencies from package metadata into repo index data and include optional deps in produced metadata\n- update dependency/planner logic to ignore dependencies provided by local split outputs and stop pulling test deps into install planning\n- auto-disable tests when required test dependencies are missing instead of hard-failing build/install paths\n- improve autotools defaults by injecting standard install directory flags when supported and preserving user overrides\n- remove static .a archives during staging by default with new build.flags.no_delete_static escape hatch\n- preserve symlinks and file metadata (permissions/timestamps) in extractor fallback copy path and add regression tests\n- refresh README docs for detached package signatures, optional dependencies, and transaction hooks\n- adjust dependency set: add filetime, disable reqwest default features, and simplify git2/OpenSSL linkage

README.md

@@ -39,9 +39,11 @@ depot install zlib-1.2.11-1-x86_64.depot.pkg.tar.zst
   - Resolves a full dependency plan first (binary repos and/or source specs), then executes in dependency order.
   - Use `--yes` for non-interactive confirmation/provider selection.
   - Use `--dry-run` to print the plan without performing work.
+  - Binary package installs verify both checksums and detached minisign signatures (`.sig`).
 - `remove <PACKAGE>`: Remove an installed package.
 - `build <SPEC>`: Build a package and create an archive without installing.
-  - Resolves and offers to install missing build/test dependencies before fetching/building.
+  - Resolves and offers to install missing build dependencies before fetching/building.
+  - Missing test dependencies automatically disable test execution for that build.
 - `info <PACKAGE_OR_SPEC>`: Show information about a package.
 - `search <QUERY>`: Search enabled source/binary repos by package name and provided features.
   - Use `--files` to search binary repo metadata file lists.
@@ -75,6 +77,7 @@ flags = { configure = ["--enable-feature"] }
 [dependencies]
 build = ["gcc", "make"]
 runtime = ["libc"]
+optional = ["bash-completion"]
 ```
 
 ## Configuration
@@ -83,3 +86,26 @@ Depot can be configured via `/etc/depot.d/` (or relative to the rootfs).
 
 - `/etc/depot.d/build.toml`: System-wide build overrides and flag appends.
 - `/etc/depot.d/package.toml`: Package-specific overrides.
+- `/etc/depot.d/hooks/*.toml`: Transaction hooks for `install`/`update`/`remove` pre/post phases.
+
+### Transaction Hooks
+
+Hook files are TOML and use Starpack-like sections:
+
+```toml
+[hook]
+name = "refresh-cache"
+
+[when]
+phase = "post"
+operation = ["install", "update"]
+packages = ["glibc", "linux*"]
+paths = ["usr/lib/*"]
+negation = ["usr/lib/debug/*"]
+
+[exec]
+command = "ldconfig"
+needs_paths = true
+```
+
+`needs_paths = true` passes affected paths to the command via stdin (newline-separated).