feat: lockfile v2 + index pin/unpin CLI + fetcher routing for custom indices

Lockfile v2: add [indices.<name>] sections with url/rev fields, add
namespace field to [package.*] entries, and v1->v2 migration on load.

CLI: add `mcpp index pin <name> [<rev>]` and `mcpp index unpin <name>`
commands for pinning/unpinning custom index revisions in mcpp.toml.
Enhance `mcpp index update` to also refresh project-level custom indices.

Fetcher routing: for deps whose namespace matches a custom git index,
check project-level .mcpp/data/ before the global xlings home. For
local path indices, read xpkg.lua directly from the index path.

E2E test covering lockfile v2 format, v1 migration, pin/unpin commands.

Author: Sunrisepeak