[M7] buildCppPackage: hermetic single-derivation, sandbox-safe

Resolve dep store paths and synthesize vendor.toml at outer eval time.
Add tests/e2e/buildCppPackage smoke fixture with a run.sh
Update CHANGELOG.md with the M7 changes.

src/resolver/nixpkgs_probe.cpp

@@ -31,8 +31,8 @@ auto make_error(util::ErrorCode code, std::string msg) -> util::Error {
 // nix eval emits these markers when an attribute is missing on the flake.
 auto looks_like_missing_attribute(std::string_view stderr_text) -> bool {
     return stderr_text.find("does not provide attribute") != std::string_view::npos ||
-           stderr_text.find("attribute '") != std::string_view::npos &&
-               stderr_text.find("missing") != std::string_view::npos;
+           (stderr_text.find("attribute '") != std::string_view::npos &&
+            stderr_text.find("missing") != std::string_view::npos);
 }
 
 } // namespace