Conill: The long-term consequences of maintainers’ actions

Distributions need to be self-contained and use local sources, including for dependencies. They shouldn't retrieve anything from the Internet during a build. Cargo has a "directory registry" mechanism that allows saying "if you'd get a crate from crates.io, get it from sources in this directory" instead.

(That said, we need a better mechanism for handling downstream patches, because right now distros just patch version 1.2.4 while pretending it's still 1.2.4. We need a way to create 1.2.4.1 instead.)