Bootstrap bytes for pkg.url. Not apt. Not a repo kind. Not canonical.
A pack is a directory. Realization id is SHA-256 of oath-tree-v1. Fetch:
/pkg/<name>/<hash>.tar
Pin desired.hash. Apply verifies the tree, not the tar.
Host development cache is .cache/oath/store. Publish with cargo make publish.