[M8] cargoxx-git dependencies: { git = ..., rev = ... } deps

CHANGELOG.md

@@ -498,3 +498,33 @@ All notable changes to cargoxx will be documented in this file.
   validation + binary-cache substitution. Phase 1a (install rules)
   and Phase 1b (path deps) shipped in this commit; phases 1c, 1d,
   and 2 remain to be built.
+- M8 cargoxx-git dependencies (`{ git = "<url>", rev = "<40-char>" }`).
+  The manifest accepts a third dep-table form:
+  ```toml
+  [dependencies]
+  mylib = { git = "https://gitea/me/mylib", rev = "abc…" }
+  ```
+  Branch/tag refs are not yet supported — the rev must be a literal
+  40-char commit. `manifest::Dependency` carries `git_url` + `git_rev`;
+  parser branches on `git`, rejects git deps that omit `rev`.
+  Lockfile schema adds `source_git_url` + `source_git_commit` +
+  `source_git_sha256` (SRI form, e.g. `sha256-<base64>`). The sha256
+  pins the fetched source as a fixed-output derivation: `pkgs.fetchgit`
+  in the consumer's `buildCppPackage` substitutes from cache when the
+  same `(url, rev, sha256)` triple appears elsewhere.
+  `cmd_build::resolve_git_dep` reuses the lockfile's prior sha256 on
+  re-builds; on a fresh dep it calls
+  `resolver::prefetch_flake_source(git+<url>?rev=<rev>)` which now
+  returns `{store_path, hash}` (extended via a new
+  `PrefetchedSource` struct, with `realize_flake_source` kept as a
+  thin compat wrapper). Verifies the dep's name by reading the
+  fetched tree's `Cargoxx.toml`. In `--offline` mode, a git dep
+  without a cached hash errors with a clear "run online first"
+  message.
+  `flake.nix`'s `evalDep` branches on `source_kind == "cargoxx-git"`
+  and feeds `pkgs.fetchgit { url, rev, hash }` into a recursive
+  `buildCppPackage` call. The fetched source is content-addressed,
+  so the entire `(fetch → install)` closure is cacheable end-to-end.
+  Codegen unchanged — the synthesized recipe (find_package +
+  `<name>::<name>` target) is identical to the path-dep case, just
+  with a different `linkdb_source` discriminator.