[M7] buildCppPackage: hermetic single-derivation, sandbox-safe

Resolve dep store paths and synthesize vendor.toml at outer eval time.
Add tests/e2e/buildCppPackage smoke fixture with a run.sh
Update CHANGELOG.md with the M7 changes.

tests/e2e/buildCppPackage/flake.nix

@@ -0,0 +1,10 @@
+{
+  description = "e2e buildCppPackage smoke";
+
+  inputs.cargoxx.url = "path:../../..";
+
+  outputs = { self, cargoxx }: {
+    packages.x86_64-linux.default =
+      cargoxx.lib.x86_64-linux.buildCppPackage { src = ./.; };
+  };
+}