fix(executor,pkginfo): stabilize hook diagnostics and dependency roots (0.0.55)

[Sunrisepeak]

What changed

• Capture Lua hook print, io.write, io.stderr:write, and log.error output per executor, retain a bounded 16 KiB tail, repair invalid UTF-8, and always return a semantic error when a hook returns false.
• Add ordered ExecutionContext::dependency_store_roots for dependencies owned by a host store outside the xlings runtime graph.
• Resolve modern host-store dependencies by literal <root>/<namespace>-x-<name>/<exact-version> paths. Valid resolver records remain authoritative; invalid records fail closed.
• Preserve old-context fallback only when the roots field is absent. An empty roots table is a modern context and does not guess.
• Bump the source-library release version to 0.0.55.

Why

• install hook: stdout/log.error/stderr swallowed — failing install() surfaces only as an empty E_INTERNAL xlings#513: hook output was written outside the structured result, while false produced an empty error. Users therefore saw an empty E_INTERNAL and lost the diagnostic that explained the package failure.
• pkginfo.install_dir() returns nil for a dependency that exists only in the shared registry cache xlings#514: mcpp.deps is a separate host dependency domain. Its payload can live in an ordered shared registry store that is neither the current package store nor an xlings runtime dependency record.

The previous #514 fallback guessed through ambient directories. That is not a valid authority boundary when same-name packages and several runtime payloads coexist.

Compatibility and authority boundary

• Namespaced modern lookups require an exact resolved version; wildcard, partial, range, and bare-name root lookups fail closed.
• A legacy bare-name resolver-record caller remains supported only when exactly one canonical same-version record exists. Cross-namespace collisions are rejected deterministically.
• Old producers with no roots field retain one warned scan/XVM fallback.
• tool_payload_dir keeps its existing compatibility path.
• No $MCPP_HOME discovery or inference was added.
• No process file descriptor redirection is used; unrelated file handles and executor instances remain isolated.

Validation

• Focused hook diagnostics: 5/5 passed.
• Focused PkgInfo_*: 11/11 passed.
• Full mcpp test: 4 test executables, 133 tests passed, 0 failed.
• git diff --check passed; mcpp.lock is unchanged.

Downstream

xlings will consume the released 0.0.55 tag in its stability-regression recovery PR and provide the end-to-end CLI/interface coverage for both issues.

Fixes openxlings/xlings#513
Fixes openxlings/xlings#514