feat: add package source compatibility controls

docs/lua-package-format.md

@@ -142,6 +142,80 @@ Check without rewriting:
 dart run tool/generate_lua_runtime_defs.dart --check
 ```
 
+## Package sources
+
+Host apps can load packages from three common sources:
+
+```dart
+// Bundled app assets.
+AssetGamePackageRepository(runtimeOptions: runtimeOptions)
+
+// Local development directory, useful when images should not be bundled into app assets.
+FileGamePackageRepository(
+  baseDirectory: 'E:/lua_packages',
+  runtimeOptions: runtimeOptions,
+)
+
+// Remote update server.
+RemoteGamePackageRepository(
+  baseUri: Uri.parse('https://example.com/lua-packages/'),
+  runtimeOptions: runtimeOptions,
+)
+```
+
+A local development directory uses the same package layout as a downloaded remote zip:
+
+```text
+E:/lua_packages/gomoku/
+  manifest.json
+  scripts/
+  assets/
+```
+
+## Remote compatibility
+
+Remote manifests may include a `compat` block. The server should use request query values to return the newest compatible package, and the client validates the returned manifest again before download.
+
+```json
+{
+  "gameId": "gomoku",
+  "version": "0.3.0",
+  "packageUrl": "https://example.com/packages/gomoku-0.3.0.zip",
+  "sha256": "...",
+  "compat": {
+    "runtimeApiVersion": 1,
+    "minRuntimeVersion": "0.4.0",
+    "maxRuntimeVersion": "0.4.9",
+    "minHostBuild": 120,
+    "platforms": ["windows", "android"],
+    "channels": ["dev", "prod"]
+  }
+}
+```
+
+`RemoteGamePackageRepository` sends these query parameters when fetching `remote_manifest.json`:
+
+```text
+runtimeApiVersion
+runtimeVersion
+hostBuild
+platform
+channel
+```
+
+Configure them through `RuntimeOptions`:
+
+```dart
+RuntimeOptions(
+  runtimeVersion: '0.4.0',
+  hostBuild: 120,
+  platform: 'windows',
+  channel: 'dev',
+)
+```
+
+If compatibility fails, the remote package is not downloaded. The repository falls back to stable cache, previous stable cache, then bundled assets.
+
 ## Package validation
 
 A host repository can validate a game package with: