fix: derive class-content emit ctx from authoritative scope state

[sini]

Problem

A static (constant-name) aspect included via den.schema.<kind>.includes whose host-class (nixos/darwin) content names an entity kind — e.g. nixos = { user, ... }: … — collapsed N sibling entities → 1 at the shared host merge. With three users on a host, only one user's content survived; the other two were dropped before evaluation by dedupByKey on a sid-free aspect identity.

Root cause

emit-classes derived its emit ctx from the per-aspect aspect.__scopeHandlers attribute. That attribute is only populated for parametric aspects (bind augmentation) or for includes propagated from a parent that already has it — and is absent for a static aspect reached through a static include chain. So such content was emitted with an empty ctx, collapsing to a base identity. The same content delivered from multiple scopes (e.g. a host aspect that also has homeManager content, reaching both the host scope and the user scopes) keyed inconsistently (base vs context-qualified), surfacing as duplicate unique-option definitions (programs.steam.package defined multiple times) the moment any per-context keying was applied.

The authoritative scope context was always present in pipeline state right next to the drop point — state.scopeContexts.${currentScope} — and is exactly what bind.nix already reads.

Fix (one handler, a unification)

1. Authoritative ctx. emit-classes now reads the scope's context from pipeline state (the same source/pattern as bind.nix), layering the aspect's own __scopeHandlers on top so fan-out child bindings still win. Gated to child scopes; the root scope keeps the historic handler-only path.
2. Key by named args. Each class-content entry is keyed by the entity kinds its function names and that are present in ctx:
   • nixos = { user, ... }: → {user=<u>} → fans per user
   • nixos = { host, ... }: → {host=<h>} → dedups across every scope it's delivered from
   • nixos = { persist, ... }: / _: → no entity kind → singular (shared infra aspects keep deduping; no double option declaration)

Validation

• just ci: 1044/1044 (adds user-scoped-host-class-fanout regression suite — the missing coverage that let this through).
• Byte-identical existing output: real nixos + k8s hosts produce the same toplevel derivation pre/post fix (drvPath diff). Only previously-miskeyed per-user content changes.