fix: quiet auto index refresh and canonical cache labels

[Sunrisepeak]

Problem

Building xlings with mcpp 0.0.36 exposed two build-tool issues:

• automatic package-index refresh runs xlings update with streaming output, leaking internal index lines like [1/7] awesome::... into mcpp build logs;
• dependency BMI cache identity and status labels can use the dependency package's embedded name/version instead of the resolved dependency key/version, so namespaced deps such as mcpplibs.tinyhttps and mcpplibs.xpkg can keep showing Compiling or cache under stale metadata.

Expected

• mcpp auto-refresh should show only the mcpp-level status line unless the user explicitly runs a manual index update.
• default index freshness should be based on an mcpp-owned refresh marker, not the mtime of pkgs/.
• dependency cache labels and keys should use the resolved dependency identity.

Validation target

Use the xlings mcpp build path as integration validation.