cargoxx-pkgs registry skeleton

Empty package registry for cargoxx. flake.nix walks
recipes/<name>/versions/*.toml, exposes each (name, version) as
packages.<system>.{<name>_<safe_ver>, <name>}, and builds via
cargoxx.lib.${system}.buildCppPackage with pkgs.fetchgit.

.gitea/workflows/validate-pr.yml validates schema, refetches and verifies
source sha256, smoke-builds, pushes $out to the binary cache, and labels
auto-merge once the PR author is in maintainers.txt.

.gitea/workflows/auto-merge.yml merges via tea on the auto-merge label.

README.md

@@ -0,0 +1,70 @@
+# cargoxx-pkgs
+
+Public package registry for [cargoxx](../cargoxx).
+
+## Structure
+
+```
+recipes/
+  <name>/
+    maintainers.txt        # gitea usernames, one per line
+    meta.toml              # description, homepage, license, repository
+    versions/
+      1.0.0.toml           # one file per published version
+      1.0.1.toml
+```
+
+## Version recipe schema
+
+`recipes/<name>/versions/<v>.toml`:
+
+```toml
+schema = 1
+name = "<package-name>"
+version = "<semver>"
+
+[source]
+type   = "git"
+url    = "https://gitea.example/<owner>/<repo>"
+commit = "<40-char-commit>"
+sha256 = "sha256-<base64>"             # SRI form; from `nix flake prefetch`
+
+[dependencies]                          # mirrors the package's Cargoxx.toml
+fmt = "10.2"
+otherlib = { version = "0.3", registry = "cargoxx" }
+
+[lock]
+nixpkgs_rev     = "<40-char>"
+flake_utils_rev = "<40-char>"
+cargoxx_rev     = "<40-char>"           # cargoxx version that built this
+
+[meta]
+description = "..."
+homepage    = "https://..."
+license     = "MIT"
+```
+
+## Maintainers
+
+`recipes/<name>/maintainers.txt` lists Gitea usernames authorized to
+publish new versions of `<name>` or edit `maintainers.txt` itself.
+Comments start with `#`; blank lines are ignored.
+
+## Publishing
+
+Use `cargoxx publish` from a checked-out cargoxx project. The tool
+opens a PR against this repository. CI validates the PR (source
+fixity, build smoke, dependency closure, maintainer match) and
+auto-merges when all checks pass.
+
+## Building locally
+
+```sh
+nix build .#<name>
+```
+
+Yields the same `$out` layout cargoxx libraries always produce —
+`lib/cmake/<name>/<name>Config.cmake`, `lib/pkgconfig/<name>.pc`,
+`lib/lib<name>.a`, `include/<name>/`. Consume from any CMake or
+pkg-config project, or from another cargoxx project via
+`{ version = "...", registry = "cargoxx" }`.