Final step of the package-management subsystem refactor (see
`.agents/docs/2026-05-08-pm-subsystem-architecture.md`). Strictly zero
behavior change.

* New module `mcpp.pm` (`src/pm/pm.cppm`) is the single import point
  for callers in `cli.cppm`, `build/`, `pack/`, etc. It re-exports the
  three pm data-type modules (`dep_spec`, `index_spec`, `lock_io`)
  but **deliberately not** the flow modules (`resolver`, `commands`,
  `package_fetcher`, `publisher`) — those stay direct-import-only so
  the encapsulation gained by R1–R6 is preserved.

* No call-site migration in this PR. Existing `import mcpp.lockfile`
  / `import mcpp.fetcher` / `import mcpp.publish.xpkg_emit` shims
  continue to work; new code can choose `import mcpp.pm` and reach
  the same data types via the new façade.

* `prepare_dependencies(Manifest&, Lockfile&, ...)` (the high-level
  operation that should replace the ~250-line dep-resolution loop in
  `cli.cppm::prepare_build`) is left for a separate PR — pulling it
  out is a non-trivial behavior-touching change that doesn't belong
  inside the strict-move R-series. The façade leaves a clean spot
  for it to land later.

Verification:
* `mcpp build` compiles unchanged.
* `mcpp test` — 9/9 unit binaries pass.
* e2e: 02 / 09 / 12 / 23 / 27 all pass.

Closes the seven-PR refactor sequence. The pm subsystem is now:

  src/pm/
  ├── pm.cppm                  (façade, this PR)
  ├── dep_spec.cppm            (R1)
  ├── index_spec.cppm          (R1 placeholder, awaits index-config)
  ├── lock_io.cppm             (R2)
  ├── package_fetcher.cppm     (R3)
  ├── resolver.cppm            (R4)
  ├── commands.cppm            (R5)
  └── publisher.cppm           (R6)