feat: publication dates, index format version, and side file pinning

[QaidVoid]

Follow-up to #14.

Publication dates. A version built from a commit hash carries no order of its own, so each resolved version now records when upstream published it.

Index format version. The index is published as {format, packages} so a client can tell an index it cannot read from one that merely lacks a field.

Side files can opt out of pinning. [[extra]] takes verify, defaulting to true. A licence sets it false: licences are served from a branch rather than a tag, so a pinned hash would turn an upstream copyright-year edit into a failed download. Binaries shipped as side files stay verified.

Two fixes found while testing that.

meta filtered side files down to those carrying a hash, which silently dropped every licence once they became unpinned.

hashfill read version files into a BTreeMap and wrote the digest tables back alphabetically, while resolve writes [url] in host.supported order. A file agreed with itself until hashfill touched it, then flipped to aarch64-first. Every table now follows the url order. This also needed the toml crate's preserve_order feature, since it sorts keys during parsing otherwise.

Resolve is usable without a token. It falls back to gh auth token when GITHUB_TOKEN is unset, detects an exhausted quota from the response headers rather than reporting a bare 403, and stops instead of repeating the same failure for every remaining package. It also reports new pins and progress, and matches a package by name as well as by directory.