feat: pivot Codectx to NixOS context checkpoints

[greygoody]

Summary

Repositions Codectx from a general repository-context compiler into a specific NixOS workflow tool.

The first vertical slice binds one declared change to:

• Git HEAD and baseline-relative paths
• a concrete flake target
• the flake.lock digest
• /run/current-system when available
• the evaluated candidate system store path

It then writes deterministic checkpoints and reports stale context when those identities change.

Public commands

codectx nix inspect
codectx nix checkpoint
codectx nix resume

Included

• Nix target specification and synthetic public example
• deterministic checkpoint schema and digest
• target, lockfile, candidate-system, active-system, and repository invalidation
• unexpected path detection
• evidence input fingerprints and stale-evidence reporting
• synthetic CLI integration test using a fake nix executable
• legacy CLI binary auto-discovery disabled
• private-data boundary for real host testing

Deliberately not included

• build or activation execution
• closure diffs
• VM tests
• remote host probing
• deployment adapters
• Orb grants or MCP transport

Those should be added only after the checkpoint/resume behavior is used across repeated private NixOS changes.

Migration note

Historical context/session modules remain in the workspace as migration material, but the primary CLI no longer exposes or builds the repository-context or legacy session product surfaces.

Validation

Passing on the PR head:

cargo fmt --all --check
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace
cargo run -p codectx-cli --bin codectx -- --help

Before merge

Keep this PR draft until the same commands are exercised against one minimal real NixOS flake. Private host/service evaluation belongs in a separate private harness and must not be copied into this public repository.