- Properly type annotate KDL.of_flow to return (t, [> `ParseError]) result
- Handle nested Results from Eio.Buf_read.parse_exn
- Fix Manifest.read to work with new Result type
- Fix nixtamal.ml error handling for Manifest and Lockfile errors

All 17 tests pass.

- Fix command injection in editor.ml using Filename.quote
- Change KDL.of_flow to return Result instead of failwith
- Update manifest.ml to handle new Result type

Security: Prevents shell injection when opening files with
malicious filenames containing shell metacharacters.

Error handling: KDL parsing errors now return Result type
instead of crashing with failwith.

Ported from upstream darcs repository (v1.1.2):
- Cmdliner 2.x compatibility fixes (variable shadowing)
- Lockfile auto-creation when missing
- Schema upgrade command with backup/rollback
- Fossil VCS support (new VCS type)
- Clean up Cmdliner warning for unescaped $PWD

Files modified:
- lib/schema.ml (new): Schema versioning module
- lib/nixtamal.ml: Add upgrade function, Fossil meld support
- lib/error.ml: Add Fossil to prefetch_method, Upgrade error
- lib/input.ml: Add Fossil module, Kind variant
- lib/prefetch.ml: Add Fossil prefetch with SRI hash support
- lib/manifest.ml: Add Fossil codec
- lib/lockfile.ml: Add Fossil lockfile type
- lib/lock_loader.ml: Add Fossil feature flag
- lib/input_foreman.ml: Add Fossil display and prefetch check
- bin/cmd.ml: Cmdliner 2.x fixes, add Upgrade command
- bin/dune, lib/dune, test/dune: Deprecation flags

Builds successfully with all tests passing.