[M3] add codegen::flake_nix

CHANGELOG.md

@@ -61,6 +61,15 @@ All notable changes to cargoxx will be documented in this file.
   `write(lock, path)` matching the format in `SPEC.md` §5. Also
   `Lockfile::nixpkgs_rev()` returns the shared revision (codegen will
   consume this in M3). `tests/lockfile_round_trip.cpp` covers 9 cases.
+- `cargoxx.codegen`: `GenerateInputs` plus the pure function
+  `flake_nix(in) -> std::string`. Substitutes the package name, the
+  resolved nixpkgs revision (defaulting to `nixos-unstable` when the
+  lockfile pins none), and a deduplicated list of dep `nixpkgs_attr`
+  entries into `buildInputs`. Output is byte-deterministic.
+  `tests/codegen_flake.cpp` covers 7 cases. Note: SPEC §7's template did
+  not show `buildInputs`; we add one between `nativeBuildInputs` and the
+  `env.NIX_CFLAGS_COMPILE` block as the natural slot for the deps that
+  TECH_SPEC §10 says we splice in.
 - SQLite overlay: `Database::open(overlay_path)` now opens (and creates,
   if missing) a per-user `linkdb.sqlite` cache, applying the schema from
   `SPEC.md` §9 idempotently. Default path is