feat: support explicit package commands

[lsaether]

Summary

Fixes #296 by allowing package-based distributions to declare the executable command separately from the installable package name.

This adds optional cmd support for package distributions so the registry can represent launch shapes like:

uvx --from <package> <cmd> <args...>

instead of assuming the package name is always the executable to run.

Why

Some packages publish under one distribution name but expose a differently named ACP executable. Issue #296 describes a PyPI package where the package name differs from the CLI command that should be launched.

This PR keeps existing behavior for manifests without cmd, while adding a way to express the explicit-command case.

Changes

• Add optional cmd to package distribution schema/docs.
• For uvx, use uvx --from <package> <cmd> <args...> when cmd is present.
• For npx, use equivalent explicit package-command launch behavior when cmd is present.
• Keep existing package launch behavior unchanged when cmd is omitted.
• Add tests for explicit cmd handling and package specs with extras/version markers.

Follow-up

If this tooling change is accepted, I plan to follow up with a separate PR adding Hermes Agent to the registry.

Hermes is blocked on this same package-vs-executable distinction: the installable package is hermes-agent[acp], while the ACP entrypoint is hermes-acp / hermes acp. Keeping that agent entry separate should make this PR easier to review as the generic registry capability requested in #296.

Validation

• uv run --with ruff ruff format --check .github/workflows
• uv run --with ruff ruff check .github/workflows
• uv run --with pytest pytest .github/workflows/tests/ -q → 118 passed
• uv run --with jsonschema .github/workflows/build_registry.py --dry-run → validated 36 agents successfully
• git diff --check