- add internal/cache content-addressed layer store; build per-wheel layers in
parallel and reuse cached compressed blobs across rebuilds (--cache-dir)
- thread platform/python target into wheel resolution; validate --env
- add common secret patterns to the default source ignore list
- README: copy/paste-safe usage example + new flags; DESIGN status updated
Co-authored-by: Jason Hall <imjasonh@users.noreply.github.com>
- wheelhouse now filters candidates by target platform/ABI/python tag and
prefers the most specific compatible wheel (fixes wrong-arch selection); also
streams sha256 and uses an index map instead of an O(n*m) scan
- wheel: add tag parser + compatibility, cap per-member size (zip-bomb guard),
reject members that escape the install prefix, stable sort
- lock: error on non-pinned/URL/editable lines instead of silently dropping
Co-authored-by: Jason Hall <imjasonh@users.noreply.github.com>
