acq configure: let durable config hold pinned custom kit refs and compose with ACQ_EXTRA_KITS #557

Summary

acq configure (ADR-0031, #500) gives users a durable place for their extra kits, but a team kit can't use it: the config only accepts catalog kit names pinned to acq's bundle, and an env-set ACQ_EXTRA_KITS replaces the configured kits entirely. Teams that ship their own kit therefore keep exporting ACQ_EXTRA_KITS from a shell rc, which silently disables every acq configure choice on that host.

Current behavior

Checked against acq 4.0.1 (1679530).

• extra_kits: in ~/.config/acq/config.yaml accepts only names from the opt-in catalog (openchamber, paseo, oci-engine); anything else fails with config extra_kits contains unknown kit (_acq_apply_configured_extra_kits, ADR-0031 "Raw refs are intentionally not accepted from durable config").
• Catalog kits resolve to PATTERNS_KIT_REF, so a team can't choose a newer kit version than acq's bundle. Example: before 4.0.0 the bundle's paseo installed Paseo CLI 0.5.2 while the team kit we maintain pinned 0.10.2, which our session backup/restore is tested against.
• When ACQ_EXTRA_KITS comes from the environment, both the configured defaults and the create-time picker are skipped (ACQ_EXTRA_KITS_FROM_ENV). There is no warning, so a user who picks a kit in acq configure on a host with a team shell block sees nothing happen.

Use case

A team kit (Team Data at login.gov: a local-path mixin kit plus pinned optional kits) is set up by a team script that writes a shell-rc block exporting ACQ_EXTRA_KITS. We'd like that script to write acq's config instead, so the team's kit choices live where acq's own UI shows and edits them, and so they survive shells that don't load the rc.

Proposal (either would unblock us)

1. Pinned custom refs in config. Allow extra_kits: entries that are full refs (git+https://…#ref=<sha>&dir=… or an absolute local path), shown in acq configure as frozen or removable rows. Keeping the "no raw refs" rule for the picker's catalog is fine; this is about entries written by a script or by hand.
2. Compose config and env. Treat env ACQ_EXTRA_KITS as additive to configured kits (deduped, env last), or at least print a one-line notice when env overrides non-empty configured kits.

Related

• feat(acq): per-repo .acq/ config for kits and dev image (one place, not per-invocation) #232 (per-repo .acq/kits) solves the per-workspace case; this one is per-user/per-team across many repos (our sandboxes clone several repos into one sandbox).
• Epic: safe kit-bundle update propagation — acq detects stale sandboxes + offers refresh #235 (kit refresh) would interact with pinned refs in config.