[M7] buildCppPackage: hermetic single-derivation, sandbox-safe

Resolve dep store paths and synthesize vendor.toml at outer eval time.
Add tests/e2e/buildCppPackage smoke fixture with a run.sh
Update CHANGELOG.md with the M7 changes.

tests/e2e/buildCppPackage/Cargoxx.toml

@@ -0,0 +1,7 @@
+[package]
+name = "e2e_demo"
+version = "0.1.0"
+edition = "cpp23"
+
+[dependencies]
+nlohmann_json = "*"

tests/e2e/buildCppPackage/flake.nix

@@ -0,0 +1,10 @@
+{
+  description = "e2e buildCppPackage smoke";
+
+  inputs.cargoxx.url = "path:../../..";
+
+  outputs = { self, cargoxx }: {
+    packages.x86_64-linux.default =
+      cargoxx.lib.x86_64-linux.buildCppPackage { src = ./.; };
+  };
+}

tests/e2e/buildCppPackage/run.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo="$(cd "${here}/../../.." && pwd)"
+cargoxx_bin="${CARGOXX_BIN:-${repo}/build/debug/cargoxx}"
+
+if [[ ! -x "${cargoxx_bin}" ]]; then
+    echo "error: cargoxx binary not found at ${cargoxx_bin}" >&2
+    echo "build it first: nix develop --command cmake --build build/debug" >&2
+    exit 1
+fi
+
+work="$(mktemp -d -t cargoxx-e2e-XXXXXX)"
+trap 'rm -rf "${work}"' EXIT
+
+cp -r "${here}/." "${work}/"
+sed -i "s|path:\\.\\./\\.\\./\\.\\.|path:${repo}|" "${work}/flake.nix"
+
+cd "${work}"
+
+echo "=== cargoxx build --no-build"
+"${cargoxx_bin}" build --no-build
+
+[[ -f Cargoxx.lock ]] || { echo "Cargoxx.lock missing"; exit 1; }
+[[ -f build/flake.nix ]] || { echo "build/flake.nix missing"; exit 1; }
+
+echo "=== nix build .#default"
+out="$(nix build .#default --no-link --print-out-paths \
+    --extra-experimental-features 'nix-command flakes')"
+
+[[ -n "${out}" ]] || { echo "nix build produced no output path"; exit 1; }
+[[ -x "${out}/bin/e2e_demo" ]] || { echo "missing ${out}/bin/e2e_demo"; exit 1; }
+
+echo "=== execute"
+"${out}/bin/e2e_demo"
+
+echo "ok"

tests/e2e/buildCppPackage/src/main.cpp

@@ -0,0 +1,9 @@
+#include <nlohmann/json.hpp>
+import std;
+
+int main() {
+    nlohmann::json j;
+    j["hello"] = "world";
+    std::println("Hello from {}!", j["hello"].get<std::string>());
+    return 0;
+}