feat: Linux/cloud platform stack (TLS, registry, static/cross, selfhost PM)

Ship the QUALITY_PLAN platform focus: thin/minimal runtime, --static/--target,
Nexus HTTPS/mTLS with graceful stop, lock checksums + install --locked,
selfhost registry (search/add/HTTP), containers, and CI smokes for cloud path.

docs/Packages.md

@@ -50,12 +50,15 @@ Default locations (first hit wins):
 2. `~/.bux/registry.toml`
 3. `config/registry.toml` next to the Bux repo / compiler
 
-HTTP indices are fetched with `curl` (or `wget`) into
+HTTP(S) indices are fetched with `curl` (or `wget`) into
 `~/.bux/cache/registry_http.toml`. Set `BUX_REGISTRY_REFRESH=1` to force
 re-download. Relative `file:` / `path:` entries in a remote index resolve
 against the cache directory — prefer **absolute paths** or **git URLs** for
 HTTP-served registries.
 
+Self-signed HTTPS registries (dev/smoke): `BUX_REGISTRY_INSECURE=1` adds
+`curl -k` / `wget --no-check-certificate`. **Do not** use this in production.
+
 Format:
 
 ```toml
@@ -100,12 +103,45 @@ bux add greet 0.1.1
 bux add utils --path "../utils"
 bux add network --git "https://github.com/bux-lang/network"
 
-# Resolve + write bux.lock
+# Resolve + write bux.lock (includes Checksum of package *.bux sources)
 bux install
+
+# CI: verify lock only (no re-resolve; fails if missing or checksum mismatch)
+bux install --locked
 ```
 
+### Lockfile (`bux.lock`)
+
+Generated by `bux install`. Each entry:
+
+```toml
+[[Package]]
+Name = "greet"
+Version = "0.1.1"
+Source = "/abs/path/or/git-url"
+Checksum = "sha1-of-sorted-bux-sources"
+```
+
+- **Reproducible:** running `install` twice with the same deps yields the same lock.
+- **`--locked`:** cloud/CI mode — does not rewrite the lock; verifies paths exist
+  and `Checksum` still matches. Fail-closed if the lock is missing or corrupt.
+
 Demo package in this monorepo: `registry/packages/greet` (registered in
-`config/registry.toml`). Smoke test: `tools/smoke_registry.sh`.
+`config/registry.toml`). Smoke test: `tools/smoke_registry.sh`
+(local + lock + `--locked` + HTTP + HTTPS).
+
+Selfhost (`buxc2`) package manager parity (sessions 80–81):
+
+```bash
+buxc2 search [query]
+buxc2 add greet              # registry resolve
+buxc2 add greet 0.1.1
+buxc2 install / install --locked
+make test-selfhost-install
+make test-selfhost-registry  # search + add + HTTP index + run
+```
+
+`$BUX_REGISTRY` / HTTP(S) cache / `BUX_REGISTRY_INSECURE` match bootstrap.
 
 ---