build(nix): add per-crate crane workspace builds

[SDAChess]

Add crane-based package outputs for the main OpenShell crates and a default symlinkJoin package. The new workspace helper derives each crate's transitive workspace dependency closure, builds from minimal source trees, and declares the assets each crate needs at compile time.

Build each crate in three layers:

1. crates.io dependencies with crane buildDepsOnly
2. first-party workspace dependency libraries
3. the final real crate

The workspace-libs layer builds the selected package with the same -p <crate> selection as final so Cargo feature unification matches, but overlays a crane-generated dummy source for the leaf crate. After that layer builds, remove the dummy leaf artifacts with cargo clean --release -p <crate> so the final layer cannot reuse or package stub outputs. This lets leaf edits reuse cached first-party libs while still compiling and linking the real leaf crate.

Add explicit [lib] target names and path = "src/lib.rs" entries to workspace crates. The Nix source minimizer keeps every member Cargo.toml but omits source trees outside the selected crate closure; explicit target paths let Cargo resolve those member manifests without relying on auto-discovery of files that are intentionally absent. They also give crane's dummy source generation a stable target shape.

Guard the openshell-core build script's .git rerun paths so Cargo does not mark core dirty in Nix source trees where .git is absent. Without this, core recompiled in the final layer and cascaded into its dependents.

Known limitation: the VM driver package is wired into the flake, but the Nix build does not yet provide the compressed VM runtime artifacts that openshell-driver-vm embeds. For now that crate builds via its stub-resource fallback rather than producing a fully usable VM driver package.

Ignore Nix result* symlinks created by local builds.

Summary

Related Issue

Changes

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[drew]

How do you see this evolving as we further integrate nix? Will this primarily be where all the nix build definitions reside? Asking mostly so I can understand how much nix we should expect to read/write in our day-to-day.

[SDAChess]

That's a very good point. I've updated the MR with a crate.nix file where you most of the editing should happen when I'm done. Of course, once the dust settles, a proper Nix skill as well as documentation is in order.