build: an apk-managed root, with SchOS as a package

make aroot builds a SchFS root from Alpine's minirootfs, the packages
ports/alpine/world lists, and SchOS itself as the signed apk package
schos-base, in its own repository inside the root. apk add installs from
Alpine; apk upgrade updates both. Booted: zsh is Alpine's, apk update
sees 28669 packages, apk add htop works, and so does xorg-server.

world.lock pins every package with its sha256; a build fetches only what
dist/alpine/ lacks and never looks for newer versions. make alpine-lock
is the one step that does.

Alpine's zsh, busybox commands and hwdata replace SchOS's copies; SchOS
keeps its own tools, toybox's other commands, and static mksh, which
schinit's recovery shell now tries first.

Also: the dependency-file include matched Alpine's usr/lib/sysctl.d, a
directory, and stopped every make. See docs/plan/alpine.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S1giNvrHTrPMPw7V6x1kQ4

ports/alpine/world

@@ -0,0 +1,18 @@
+# Alpine packages built into the apk-managed root, one per line.
+#
+# Edit this, then run `make alpine-lock` to resolve it, with every dependency,
+# into world.lock -- exact versions and checksums. A normal build installs
+# exactly what world.lock says from dist/alpine/, downloading only files it
+# does not have yet, and never asks Alpine what is newer. That happens only
+# when you run `make alpine-lock` again.
+#
+# Anything else is one `apk add` away on the running system; this list is
+# what a fresh image starts with.
+
+# The login shell. Replaces SchOS's own zsh port.
+zsh
+# Terminal descriptions for zsh, htop, and everything else that draws.
+ncurses-terminfo-base
+# The PCI and USB ID databases: lspci, fastfetch and Xorg read them.
+hwdata-pci
+hwdata-usb