Version 0.3.0: resolver/merge/cache refactor, signing design notes

- Split the monolith into package/provider/fetch/merge/cache modules with
  the Resolver deciding install/adopt/update/merge/conflict outcomes
- Three-way merges via git merge-file/diff3 against a content-addressed
  merge-base cache; conflicts go to a .picopackage-merge sibling
- Tests for package, provider, resolver, merge, and cache
- notes.md: update UX and signing design — diff-by-default, SSH signature
  identity pinning (TOFU), key changes as a hard stop, exit-code contract
- Add CLAUDE.md; remove the pre-refactor exe/pppkg monolith and scratch files

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EiyJC73Mz8xZyCTvCEY8qn

test/test_merge.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class TestMerge < Minitest::Test
+  BASE = "one\ntwo\nthree\n"
+
+  def test_a_backend_is_available
+    assert Picopackage::Merge.available?, "expected git or diff3 on PATH"
+  end
+
+  def test_non_overlapping_changes_merge_cleanly
+    result = Picopackage::Merge.three_way(
+      base: BASE,
+      ours: "ONE\ntwo\nthree\n",
+      theirs: "one\ntwo\nTHREE\n"
+    )
+
+    assert_predicate result, :clean?
+    assert_equal "ONE\ntwo\nTHREE\n", result.content
+  end
+
+  def test_identical_changes_on_both_sides_merge_cleanly
+    changed = "one\nTWO\nthree\n"
+    result = Picopackage::Merge.three_way(base: BASE, ours: changed, theirs: changed)
+
+    assert_predicate result, :clean?
+    assert_equal changed, result.content
+  end
+
+  def test_overlapping_changes_conflict
+    result = Picopackage::Merge.three_way(
+      base: BASE,
+      ours: "one\nMINE\nthree\n",
+      theirs: "one\nTHEIRS\nthree\n"
+    )
+
+    assert_predicate result, :conflict?
+    assert_operator result.conflicts, :>, 0
+    assert_includes result.content, "MINE"
+    assert_includes result.content, "THEIRS"
+    assert_includes result.content, "<<<<<<<"
+  end
+
+  def test_labels_appear_in_conflict_markers
+    result = Picopackage::Merge.three_way(
+      base: BASE,
+      ours: "one\nMINE\nthree\n",
+      theirs: "one\nTHEIRS\nthree\n"
+    )
+
+    assert_includes result.content, "local"
+    assert_includes result.content, "upstream"
+  end
+end