cmd/cue: support $pkg@$version specification of packages

[myitcv]

What version of CUE are you using (cue version)?

$ cue version
cue version v0.0.0-20241204160345-46c1cb24b09b

go version go1.23.2
      -buildmode exe
       -compiler gc
  DefaultGODEBUG asynctimerchan=1,gotypesalias=0,httpservecontentkeepheaders=1,tls3des=1,tlskyber=0,x509keypairleaf=0,x509negativeserial=1
     CGO_ENABLED 1
          GOARCH arm64
            GOOS linux
         GOARM64 v8.0
             vcs git
    vcs.revision 46c1cb24b09b3981a5a7e585cba80cabfa8bc8e2
        vcs.time 2024-12-04T16:03:45Z
    vcs.modified false
cue.lang.version v0.12.0

Is your feature request related to a problem? Please describe.

It is proving to be common to want to refer to a package in version of a published CUE module but not be module context when doing so. This is possible in Go, for example:

$ go run golang.org/x/tools/cmd/digraph@v0.28.0 -help
go: downloading golang.org/x/tools v0.28.0

The digraph command performs queries over unlabelled directed graphs
represented in text form.  It is intended to integrate nicely with
typical UNIX command pipelines.

Usage:

        your-application | digraph [command]

...

This command can be run anywhere, and requires/uses zero context from the working directory: it only relies on the configuration described by go env.

Having something similar in CUE would allow:

• "Standalone" validation of data files, e.g. cue vet $pkg@$version -d '#schema' data.yaml
• Plain evaluation/export of published packages at known versions, providing reproducible output, e.g. cue export $pkg@$version -e part.of.config

Describe the solution you'd like

The ability to run cue/cmd commands with a package specification of $pkg@$version, where $pkg is a fully qualified package path, and $version is a semver version or a version query like @latest.

Describe alternatives you've considered

The alternative requires:

• setting up a temporary local main module
• establishing dependencies
• running commands there against the main module's dependency

Additional context

n/a