feat(flake): build comment-checker from source, drop fetchurl hashes

[systemfsoftware-maker]

Summary

The flake now builds the comment-checker binary from this repo's own source via rustPlatform.buildRustPackage, pinned to the repository's rust-toolchain.toml toolchain. Previously the flake downloaded a GitHub release asset through a fixed-output fetchurl and baked its four SRI hashes into the flake; when the release assets were re-uploaded, those hashes drifted and the flake served a stale binary for weeks without any gate noticing (#81).

With a source build there is no hash to drift, and no stale fork can re-enter: the derivation always carries the current tree. The release-then-sync machinery is deleted (the sync script itself, the SRI helpers, the hash check and its error classes, the release-side sync step). The version binding stays so the existing version-sync surface keeps bumping it in lockstep with npm and cargo.

Why a source build

• The flake-input alternative (using github:systemfsoftware/comment-checker as the repo's own source) would freeze the version and cycle nix flake update — measured, rejected.
• doCheck = false in the derivation: crate tests run in CI, not inside the nix build (and no tests ride the flake gate).
• The source filter keeps Cargo.toml, Cargo.lock, crates/, and .cargo/ in the store source, so the derivation builds exactly the pinned manifest.

CI nix gate

The new nix job on pull requests and master now does all three:

1. nix flake check — evaluation of the flake.
2. nix build --no-link .#packages.x86_64-linux.comment-checker-bwrap — a real build of the shipped derivation. (Eval-only gating is what let a dropped Cargo.toml slip past in review; the gate now compiles the actual binary.)
3. A smoke step asserting the built binary's --version equals the workspace Cargo.toml version, so the next release cannot ship a flake that reports a different version than npm/cargo.

Validation

nix build --no-link .#comment-checker compiles end-to-end under the pinned toolchain (exit 0). check-versions: ok npm=0.3.2 workspace=0.3.2. The review that caught the filter and gate defects ran both the fixed derivation build and the eval-only failure mode locally before the fixes.

Related: #81

---