pkg: recognize default dune build commands

Adds Dune_default_build_commands as the single source of truth for the
shapes dune emits in generated opam files. Each shape is an
OpamTypes.command list constructed in OCaml, consumed both for
generation (via OpamPp.print on OpamFormat.V.command, consistent with
how depends/conflicts/etc. are built) and for detection (by structural
equality with the same values).

When an opam package's build: field matches one of the canonical shapes
and the package carries no install:/patches:/substs:/build-env: steps,
the lockfile records the (dune) keyword instead of translating the opam
commands into a dune action, enabling dune to build the package
in-process rather than spawning a separate dune process per dependency.

The conservative field gate is necessary: the (dune) shortcut at
src/dune_rules/pkg_rules.ml expands to a bare 'dune build -p <name>',
which cannot reproduce patch application, opam substitute steps, or a
Withenv wrapper for build-env. Packages carrying those fields fall
through to the explicit action branch in src/dune_pkg/lock_pkg.ml
which emits each step.

Replaces opam_create.ml's inline string templates with calls to the
shared module; output is byte-identical (verified by existing
opam-file-generation snapshot tests).

Builds on #13592 by gridbugs, broadening coverage from one shape to
every shape dune itself emits (before_1_11, from_1_11_before_2_7,
from_2_7, from_2_9, from_3_0 with subst/sites toggles, and from_3_23
with an exclusive_dir runtest target).

---

Survey of ocaml/opam-repository (2026-05; 29,475 opam files,
16,832 dune-using; 4,518 packages, 2,987 dune-using latest), grouped
by build-shape category alone (ignoring install:/patches:/substs:/
build-env:):

                            per opam file     per package (latest)
                            (16,832 dune)     (2,987 dune)
     no-targets               45.78%            44.63%
     extra-step               31.46%            16.37%
     default                  15.78%            30.80%
     missing-runtest           3.44%             3.15%
     other                     2.58%             3.45%
     extra-flag                0.53%             1.07%
     missing-doc               0.35%             0.40%
     j-literal                 0.05%             0.03%
     missing-install           0.02%             0.10%

Combined is_dune_default coverage (default + no-targets + from-3-23,
gated on empty install/patches/substs/build-env):
  per opam file        53.94% (9,080 / 16,832)
  per package latest   66.99% (2,001 /  2,987)

The conservative field gate excludes a negligible slice: 87 of 9,167
shape-matching opam files (0.95%) and 24 of 2,025 latest packages
(1.19%). The dominant disqualifier is install:; patches/substs/
build-env each affect single-digit numbers of latest packages.

"extra-step" is the largest unmatched bucket and is dominated (~78%
per latest) by 'rm -r vendors' + 'dune build', used by tezos to clean
vendored deps before building. The remainder is a long tail of
./configure / sh / mv steps. None of these can be reproduced by a bare
'dune build -p name', so they are correctly excluded.

Signed-off-by: Ali Caglayan <alizter@gmail.com>

Author: Alizter

doc/changes/added/XXXX.md

@@ -0,0 +1,6 @@
+- When generating a lockfile, recognise opam packages whose `build:` field
+  matches one of the canonical shapes dune emits in its own opam files, and
+  record the `dune` keyword for them rather than translating the opam
+  commands into a dune action. Detection covers every shape historically
+  emitted (lang < 1.11 through >= 3.23). Builds on #13592. (#XXXX,
+  @gridbugs, @alizter)