[dmjio]

Stacked on #21; the base is project-local-deps. Merge #21 first, then retarget this PR to main.

Why

miso shipped among the tool's packages, so every project used whatever miso the tool came with, and miso.lock didn't record it. A new release of the tool silently changed the miso of every existing project.

What changes

• miso is a dependency. miso new (and miso init) write dependencies: [miso], and miso.lock locks it as a git dependency at a commit of dmjio/miso.
• - miso means "the miso of this release". That's the flake.lock commit the release was built from; mhs-VERSION/miso-default records the repository, commit, version and flags. It's locked at that commit with no network access. miso install copies the prebuilt package from mhs-VERSION/miso-prebuilt/ when the locked commit and flags match and nothing it was built against has been replaced. Otherwise it builds miso from the source the release ships, without downloading.
• Upgrading the tool doesn't change a locked project's miso. The lock keeps its commit. miso update moves it to the new release's commit. A project can also use another miso with git:, path: (with the release's flags) or a Hackage version:.
• Release: scripts/prebuilt-miso.sh takes miso out of the tool's package database, so it's no longer on mhs's path. build-release.sh and flake.nix both run it.
• Compatibility:
  • A project whose code imports Miso without depending on it gets the release's miso, with a warning that says how to add the dependency.
  • With an older release (no miso-default), miso is among the tool's packages as before.
  • miso doctor checks for the prebuilt miso.

Testing

Run against a local release of this branch (MicroHs 0.16.10.0, x86_64 macOS):

scenario	result
new project (browser target, emcc)	Installing miso at a3e6937 (1.14.0.0) (built already, as it came with this miso); builds
second new project	miso from the store
miso lock	miso locked as a git dependency at a3e6937, version 1.14.0.0
project with dependencies: [] that imports Miso	builds, with a warning
the tool's default miso changed	the locked project keeps a3e6937 (one-time clone of dmjio/miso, since the new tool doesn't ship that source)
scripts/smoke-test.sh	passes; it now also checks that a new project depends on miso, installs the prebuilt one, and locks it

Not tested:

• A miso project that replaces transformers. By design, miso is rebuilt from the shipped source against the replacement, because its store key includes the replacement's ID.
• The flake.nix change (CI builds it).