feat(xpkg): centralize resource source normalization

[Sunrisepeak]

Summary

• add additive xpm.source and platform-level source metadata without changing the platform/version model
• add mcpplibs.xpkg.compat as the single resource normalization entry point
• preserve legacy XLINGS_RES, res = true, explicit URL, per-arch map, mirrors, aliases, and ref behavior
• make loader tests discoverable by mcpp and keep build fixtures immutable
• bump libxpkg to 0.0.43

Validation

• mcpp build passes
• test_loader: 26/26 pass, including 8 compat cases
• test_index: passes
• test_model: passes
• full mcpp test retains four pre-existing elfpatch executor failures; the same four failures reproduce on clean main@9e934be

Part of openxlings/xlings#356.