fix(package): search Linux home data fallback

[floze-the-genius]

Fixes #2492.

Summary

• search the Linux home-data fallback after the XDG data root when default
  local package paths are used
• keep explicit package paths authoritative
• resolve exact and latest package versions across every configured root
• cover fallback ordering, explicit-path behavior, and deduplication

On Linux the default order is now:

1. dirs::data_dir()/typst/packages
2. $HOME/.local/share/typst/packages

The paths are deduplicated. Non-Linux behavior is unchanged, and callers that
provide an explicit package path still use only that path.

Validation

Rebased exactly onto current main (b1119249); the range-diff maps the
original commit 8d9e237e unchanged to bdbc6301.

• Rust 1.92: RUSTFLAGS=-Dwarnings cargo test -p tinymist-package --features system
  — 2/2 passed on macOS
• Rust 1.92: cargo clippy -p tinymist-package --all-targets --features system --no-deps -- -D warnings
  — passed
• cargo fmt --all -- --check — passed
• git diff --check — passed

The Linux-only deduplication test is cfg-excluded on this macOS host and still
requires the repository Linux workflow. Dependency-inclusive Clippy currently
stops in unchanged main code at
crates/tinymist-std/src/fs/paths.rs:829 (undocumented_unsafe_blocks) before
reaching this crate; the targeted --no-deps check above passes.

AI assistance

OpenAI Codex assisted with investigation, implementation review, rebase, and
validation. I reviewed the final diff and take responsibility for it.

[floze-the-genius]

@Myriad-Dreamin I rebased this exactly onto current main (bdbc6301, 0 behind). The patch keeps the XDG package root primary, adds $HOME/.local/share as the deduplicated Linux fallback exposed by the reporter MWE, and leaves explicit paths/non-Linux behavior unchanged. On Rust 1.92 the package tests pass 2/2 on macOS and targeted all-targets Clippy --no-deps -D warnings passes; the Linux-only dedup test still needs repository CI, and the PR body records the unrelated dependency-inclusive current-main Clippy finding. tinymist::ci and the latest title check are waiting for maintainer approval. Could you approve the workflows and review when convenient?