feat: search 结果与 add 建议显示包的可用版本（默认最新 3 个，--all-versions 全量）

[wellwei]

Summary

Closes #487，补上 #324 遗留的「建议不带版本」半边。

mcpp search <keyword>：命中行追加该包描述符 per-OS 版本表的并集——semver 降序、按键去重，默认显示最新 3 个并以 , ... 标记截断；--all-versions 显示全部。描述符不可读或未发布任何版本的包保持原两列输出，富化是尽力而为的展示，不是新的失败路径。

$ mcpp search imgui
  compat:imgui      Dear ImGui immediate-mode GUI library core sources       (1.92.8, 1.92.8-docking)
  mcpplibs:imgui    C++23 module package for Dear ImGui core and GLFW/OpenGL3 backends  (0.0.6, 0.0.5, 0.0.4)
  ocornut:imgui     Dear ImGui 1.92.8 core and GLFW/OpenGL3 backend modules for mcpp (import imgui.core;)  (1.92.8)

$ mcpp search imgui --all-versions   # mcpplibs:imgui → (0.0.6, 0.0.5, 0.0.4, 0.0.3, 0.0.2, 0.0.1)

mcpp add ns.name@ver 未命中时：跨命名空间建议从裸 FQN 升级为带版本：

  a package with this name exists under another namespace:
    compat.eui-neo (0.5.6, 0.5.5, 0.5.3)

数据是白捡的：did-you-mean 扫描本就要打开每个候选 .lua 读身份（#278），版本只是同一段文本的再一次遍历。build 失败路径的同款提示同步升级，两条路径不说两套话。warn_unpublished_version 的 warn-not-fail 策略不动。

实现

• manifest::merge_xpkg_versions_desc：per-OS 键列表的并集视图。排序用 version_req 的 SemVer 解析；不可解析的键保留原文排在最后（版本模型:精确键能表达上游的一切,范围表达不了 —— 且 lock 记的是范围本身 #363 的教训：任意的索引键无法从解析形态复原）；等值异写（1.0/1.0.0）保持首见序。
• descriptor spec 与安装目标口径不一致:package.name 写成 split 形式(namespace + 短名)的索引包无法被任何消费端安装,且 lint 静默放行 #278 的扫描由 scan_fqns_with_short_name 改为 scan_short_name_matches，携带 fqn + versions。三条约束不变（只在已失败路径调用、结果只进错误文本/展示、空结果不是错误），版本列表受同一纪律约束——描述存在性，不做解析输入。
• cross_namespace_matches 更名 cross_namespace_suggestions 返回富记录；prepare.cppm 与 commands.cppm 两个调用点同步渲染。
• Fetcher::versions_for_hit：search 命中的 ns:name → 描述符 → 版本并集；无 ns 前缀或读不到描述符返回空。

Test plan

• 单测 95 通过 0 失败（新增：merge 排序 8 例含预发布/四段/不可解析键；扫描携带版本 3 例；versions_for_hit 3 例）
• tests/e2e/162_bare_name_namespace_scope.sh 扩展并全绿：build 路径断言 acme.widget (1.0.0)、add 路径断言 compat.gadget (2.0.0)，且被拒的 add 不写 manifest
• 相邻 E2E 用 fresh 二进制通过：12_add_command.sh、93_xpkg_parse.sh
• 真机实测：mcpp search imgui [--all-versions] 与 mcpp add mcpplibs.eui-neo@1.0.0 输出符合上述契约

[Sunrisepeak]

Reviewed and carried forward as #573, with a Co-authored-by trailer so the squash keeps your authorship. Your branch is in a fork this repository cannot push to, so the rebase onto current main (73 commits of drift; the code merged cleanly, only the CHANGELOG conflicted — its entry sat under a [2026.8.22.1] section that no longer exists) landed on a base-repo branch instead.

The design holds and went in as written: the scan #278 already pays for on a failed lookup is reused rather than a new index built, and both constraint comments are explicit that the version list is display-only and never a resolution input. read_xpkg_lua is a local read, so the enrichment costs mcpp search no network call.

One behavioural gap, and one consolidation:

mcpp search truncated without saying so. The PR grew two joins of the same list — ShortNameMatch::versions_label and a file-local join_versions in index_management — and only the first appended the , ... marker. So search cut to three and said nothing, against a description that promises the marker and against mcpplibs:imgui, which has six versions. Nothing tested it. Both callers now render through one manifest::join_versions_desc, with the count policy as one kVersionsShown, and a unit test pins the truncated and exact-fit cases.

The platform axis existed already. versions_for_hit and the scan each spelled it {"linux", "macosx", "windows"}; platform::xpkg_platforms is the one definition, so both now call manifest::all_xpkg_versions_desc. merge_xpkg_versions_desc also parses each key once beside the key rather than on every comparison — the ordering, stable_sort included, is unchanged, so 1.0 and 1.0.0 still hold first-seen order.

mcpp search is not documented under docs/ at all, so --all-versions has nowhere to go short of writing that section; left as it is.

Thanks — the reasoning in the constraint comments is what made this quick to review.

[Sunrisepeak]

Merged as 090c016 — the squash carries Co-authored-by: wellwei <ywellwei@qq.com>. Closing here because this branch is in a fork the repository cannot push to, so the rebase onto current main and the review fixes landed on a base-repo branch instead. Thanks for the feature.