Roadmap: add content-addressed package store and .spore-lock workflow

[zrr1999]

Problem / current limitation

The package/module design still advertises more than the implementation: there is no shipped content-addressed package store, lockfile flow, or end-to-end publish/install path that matches the SEP-0008 direction.

Evidence

• spore-evolution/seps/SEP-0008-module-and-package-system.md describes lockfiles, store semantics, and registry-backed workflows that are not yet implemented.
• The release truth pass had to caveat registry/package workflows as roadmap-only.

Target behavior

• Implement a local content-addressed package store and .spore-lock representation for resolved dependencies.
• Define the minimum supported workflow for add/resolve/install using current project metadata.
• Keep unsupported remote-registry steps explicitly marked as future until the registry API exists.

Acceptance tests

• Resolver tests cover lockfile generation and deterministic reinstall.
• CLI tests cover offline/local store resolution from a checked project.
• Docs describe what is supported now versus future registry integration.

Release priority

P1 / roadmap after first public release