Collisions between different hermit distributions

My company uses a private internal-only Hermit.

We’ve had problems caused by running the public hermit and our internal hermit on the same machine. In particular, some package names collide, so we get the public OpenJDK when expecting our internal packaging of OpenJDK.

I’d like for Hermit to prevent such collisions from causing us grief. Perhaps by namespacing packages on the filesystem using a hash? Instead of `pkg/k9s-0.27.4/` it would be something like `pkg/9s-0.27.4-a5c4faa30`.

We’re currently working around this problem by setting an environment variable on CI builds where this problem is most pronounced:

```
export HERMIT_STATE_DIR=$HOME/Library/Caches/hermit-square
```

Start by tracing how Hermit derives package paths under pkg/ and how HERMIT_STATE_DIR separates state. Compare the public and private distribution cases described here, then define how namespacing should prevent identical package names from colliding. Done means the collision behavior is specified and verified for separate Hermit distributions.

Written by the indexing model from the issue text.