feat: support channel filtering in SDF

[upils]

• Have you signed the CLA?

---

Adds a channel field to slice definition files, so a single SDF can describe content that differs across the channels of a store package. Values are <track>/<risk> patterns where the risk part accepts * (any risk), !<risk> (any but that one) and <risk>,<risk> (only those); a list of values is a union, and a track may appear at most once. It is accepted on contents paths and on essential entries, requires store and format v3+, and behaves throughout like arch: non-matching entries are silently skipped, conflict validation and the manifest ignore it.

Patterns are kept as written in []string and interpreted on each match — the structure strdist uses for globs — and validated when the release is read, so malformed values fail on ReadRelease rather than on cut. Filtering happens at the three places arch already filters: the two content loops in slicer.Run and the essential traversal in order, where the gate uses the channel of the package holding the essential.

---

⚠️ The slicer filter lines have no test coverage yet. channel is only legal on store packages, and store fetching still returns not implemented, so those two lines are unreachable from a test. Parse and select layers are covered. If the store fetching lands before this PR, tests must be added.