fix(xpkg): 0.0.47 and 0.0.48 were swallowed by a malformed 0.0.49 entry

`mcpplibs.xpkg@0.0.48` stopped resolving — openxlings/xlings#486. The index
file parses as valid Lua, which is why nothing caught it: the damage is
semantic, not syntactic.

0.0.49's entry lost its `sha256` line and its closing brace, so every entry
below it became a FIELD OF 0.0.49 rather than a sibling:

    ["0.0.49"] = {
        url = { ... },
    ["0.0.48"] = { ... },        <- nested
    ["0.0.47"] = { ... },        <- nested
            sha256 = "45f23...", <- 0.0.49's, orphaned down here
    },

Lua reads that happily. `xlings info mcpplibs:xpkg` then listed
0.0.50, 0.0.49, 0.0.46, 0.0.45 — with 0.0.47 and 0.0.48 simply absent, and
absent reads exactly like never published.

Mine, from #156: the reorder that moved 0.0.49 to the top of the list used a
non-greedy regex, which stopped at the closing brace of the nested `url`
table instead of the entry's own. Half the entry moved; the tail stayed.

Verified by parsing the file with lua5.4 and enumerating the keys — 9 versions
before, 11 after. A structural check is the only thing that would have caught
this, since every text-level check passes.

Author: Sunrisepeak

pkgs/x/xpkg.lua

@@ -24,6 +24,8 @@ package = {
                     GLOBAL = "https://github.com/openxlings/libxpkg/archive/refs/tags/0.0.49.tar.gz",
                     CN     = "https://gitcode.com/mcpp-res/xpkg/releases/download/0.0.49/xpkg-0.0.49.tar.gz",
                 },
+                sha256 = "45f23d16aba01833cc38ad4a2a117ab2646d9c0edad5f4c9eafecc53a70457ff",
+            },
             ["0.0.48"] = {
                 url    = {
                     GLOBAL = "https://github.com/openxlings/libxpkg/archive/refs/tags/0.0.48.tar.gz",
@@ -37,8 +39,6 @@ package = {
                     CN     = "https://gitcode.com/mcpp-res/xpkg/releases/download/0.0.47/xpkg-0.0.47.tar.gz",
                 },
                 sha256 = "fe879e8f52ea5a7f316ca54bca1fa393febb8e2a23a3de852b0c2be1918a0be9",
-            },
-                sha256 = "45f23d16aba01833cc38ad4a2a117ab2646d9c0edad5f4c9eafecc53a70457ff",
             },
             ["0.0.46"] = {
                 url    = {