DependencyEnsurer — composes IShell + IDistroDetector + IPackageInstaller
to deliver the user-level `ensure!` verb.

The record itself is pure-data + dispatch; every side effect goes
through one of the three injected ports. Tests exercise the policy
matrix (`:auto` / `:ask` / `:throw`) by feeding fakes.

Protocols for the dependency-ensurer subsystem.

## Why this exists

Tools that shell out (`ssh`, `sshpass`, `pass`, `gpg`, `clojure`, …)
currently assume the binary is on PATH. When missing, calls explode
with a confusing `IOException: Cannot run program …` deep in
babashka.process. This namespace introduces the user-level verb
"make sure I can call X" — composing narrower ports
(`IShell` from `hive-system.protocols`, plus `IDistroDetector` and
`IPackageInstaller` defined here) so each impl stays ISP-narrow.

## ISP boundary

- `IDistroDetector`  — "which Linux/BSD/macOS family am I on?"
  One axis of variance: distro identity. Pure-ish (reads
  `/etc/os-release`, `uname`, etc.).
- `IPackageInstaller` — "install package X via the system pkg mgr".
  One axis of variance: package manager (apt / dnf / pacman / brew …).
  All side effects.
- `IDependencyEnsurer` — the user-level facade that composes the
  above three to deliver a single `ensure!` verb.

New distros plug in via new `IDistroDetector` impls; new package
managers via new `IPackageInstaller` impls. `IDependencyEnsurer`
itself stays distro/manager-agnostic.

Standard local-host adapters for IDistroDetector and IPackageInstaller,
plus a `default-ensurer` factory that wires the whole thing up using
the existing `hive-system.shell.core/make-shell` adapter.

Adapters here read `/etc/os-release` and shell out to apt-get / dnf /
pacman / brew via the injected IShell. They never auto-install during
construction; only `install!` runs effects, and only when explicitly
invoked by `IDependencyEnsurer/ensure!` under an `:auto` or accepted
`:ask` policy.

Tests use *fake* IShell + fake distro/installer impls — see
`test/hive_system/deps/core_test.clj`.