[M5+] flake codegen + SPEC §7/§10 amendment for per-dep nixpkgs pins

CHANGELOG.md

@@ -91,6 +91,26 @@ All notable changes to cargoxx will be documented in this file.
   6 cases against fixtures derived from a real fmt 10.2.1 response;
   `tests/devbox_resolve_live.cpp` (gated by `CARGOXX_NETWORK_TESTS=1`)
   hits the live API.
+- `flake.nix` codegen rewritten for **per-dep nixpkgs revisions**. The
+  shared `nixpkgs` input always tracks `nixos-unstable` and provides
+  the toolchain. Each pinned manifest dep
+  (`<pkg>@<concrete-version>` whose lockfile entry has a non-null
+  `nixpkgs_rev`) gets its own `nixpkgs_<sanitized>` input, a
+  matching outputs-lambda parameter, a `pkgs_nixpkgs_<sanitized>`
+  `let` binding, and a `pkgs_nixpkgs_<sanitized>.<attr>` line in
+  `buildInputs`. Wildcard / unpinned deps stay on the shared
+  `pkgs.<attr>`. Sanitization replaces every char outside
+  `[a-zA-Z0-9_]` with `_`, giving a single identifier-safe form for
+  all three Nix contexts. Two pinned deps that share the same
+  `(name, version)` are deduplicated. Live verified:
+  `cargoxx new app && cargoxx add fmt@10.2.1 && cargoxx add zlib &&
+  cargoxx build` produces a binary that calls fmt 10.2.1 + zlib from
+  the toolchain nixpkgs; a second `cargoxx build` regenerates
+  byte-identical `flake.nix` + `Cargoxx.lock`.
+- SPEC.md §7 (flake template) and §10 (version resolution) amended
+  to describe the per-dep model. The previous single-shared-rev
+  whole-project SAT was retired (user-directed; documented ABI
+  trade-off).
 - `cargoxx build` now **merges** rather than overwrites
   `Cargoxx.lock`: when an existing entry's `(name, version)` still
   matches the manifest, its `nixpkgs_rev` is preserved. New deps and