Version 0.3.0: resolver/merge/cache refactor, signing design notes

- Split the monolith into package/provider/fetch/merge/cache modules with
  the Resolver deciding install/adopt/update/merge/conflict outcomes
- Three-way merges via git merge-file/diff3 against a content-addressed
  merge-base cache; conflicts go to a .picopackage-merge sibling
- Tests for package, provider, resolver, merge, and cache
- notes.md: update UX and signing design — diff-by-default, SSH signature
  identity pinning (TOFU), key changes as a hard stop, exit-code contract
- Add CLAUDE.md; remove the pre-refactor exe/pppkg monolith and scratch files

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EiyJC73Mz8xZyCTvCEY8qn

CHANGELOG.md

@@ -1,5 +1,55 @@
 ## [Unreleased]
 
+### Added
+
+- Three-way merge on update, so a locally edited picopackage can still take
+  upstream changes. Conflicts are written to `<file>.picopackage-merge` and the
+  original file is never touched.
+- `base_checksum` metadata: the upstream payload a file was last reconciled
+  with. Doubles as the key into a content-addressed merge-base cache under
+  `$XDG_CACHE_HOME/picopackage` (`PICOPACKAGE_CACHE` overrides).
+- Unrecognised metadata keys are preserved across rewrites instead of being
+  dropped.
+- An upstream metadata block is explicitly optional. Any plain file is a valid
+  source; a block lets a publisher assert a canonical `url`, `filename`,
+  `payload_version` and licence, which are adopted as given.
+- `ppkg verify`, `ppkg package --url`, `ppkg scan` output with urls, and
+  `ppkg help`.
+
+### Changed
+
+- Resolution is decided by checksum, never by mtime. A file whose payload
+  matches upstream is up to date however the timestamps compare.
+- Merges run on the payload only; the metadata block is regenerated afterwards
+  rather than merged.
+- A locally edited file whose upstream hasn't moved reports `current` instead of
+  running a no-op merge. It also restores the merge base to the cache, so a
+  cleared cache recovers on the next `update` rather than at the next conflict.
+- Fetching uses `net/http` directly instead of `URI.open`, which treats a
+  leading `|` as a command to run. Redirects (max 5, `http`/`https` only),
+  `If-None-Match`, streamed size caps and typed errors come with it.
+- `update` writes back to the local filename rather than upstream's preferred
+  one, so a renamed package doesn't install a second copy.
+- Timestamps are ISO 8601 from every provider.
+
+### Fixed
+
+- Checksums are computed over the normalised payload everywhere. Written
+  packages previously failed their own verification, so every file looked
+  locally modified.
+- Provider selection no longer aborts when a speculative provider guesses wrong,
+  so plain URLs reach `DefaultProvider`. A 404 now reports as a 404 rather than
+  "no provider could handle this".
+- `Scanner` returns usable results and survives binary, unreadable and oversized
+  files.
+- `ppkg verify` reads the checksum it actually writes; `ppkg package` saves.
+- A metadata block containing only unmodelled keys is no longer treated as a
+  bare file and overwritten.
+- Checksums are derived at write time, never adopted from an input. Installing
+  from an upstream whose block carried a stale `payload_checksum` produced a
+  file that failed its own verification and reported as locally modified before
+  anyone had edited it.
+
 ## [0.2.0] - 2025-01-21
 
 - Rename to from Picop to Picopackage