Replace the findPkgRoot heuristics with a resolved PackageContext

Follow-up from the review of #88, #89 and #96.

findPkgRoot() has grown into a pile of structural heuristics that each new repository layout extends: known category directories, skip directories, LuCI payload directories, the root-level package fallback, Makefile probing, and per-family exemption lists that individual validators keep their own copies of (['u-boot.mk', 'trusted-firmware-a.mk', 'luci.mk'] now appears in the release audit, and the metadata check has a second list of its own).

Proposal: resolve a changed file to a single PackageContext once and let every validator read its capabilities from there.

changed file
   ↓ walk parents upward
   ↓ probe Makefile
   ↓ classify package family
   ↓
{
  root: 'babeld',
  family: 'regular' | 'luci' | 'uboot' | 'trusted-firmware' | 'host-tool',
  makefile: '...',
  usesPkgRelease: true,
  requiresMaintainer: true,
  requiresLicenseFiles: true
}

That would give the release audit, the hash audit, the metadata check and the UCI check one source of truth instead of one exemption list each, and adding a repository layout or a package family would be a single change rather than a change per validator.

Not urgent — the current fixes are correct as they stand. This is about keeping them maintainable.

Start by tracing findPkgRoot() and the release audit, hash audit, metadata check, and UCI check that duplicate package-family logic. Define how one resolved PackageContext should expose the listed package capabilities and replace the separate exemption lists. Done means the validators share that context while preserving the current fixes and supporting future layouts or package families through a single change.