docs(flake): annotate KEEP+DEP rationale per standards#102 rule 3 (#15)

Per the campaign gate, this flake is LOAD-BEARING — guix.scm uses
cargo-build-system with no named inputs (cargo vendors everything);
the sealed Containerfile installs only `rust cargo`. This flake's
devShell is the sole source of the rust-overlay rustToolchain and
the Rust dev-tool surface (cargo-watch, cargo-edit, cargo-audit,
cargo-deny, cargo-fuzz), plus the RSR-template common tools (git,
just, nickel, curl, bash, coreutils).

Refs standards#101 standards#102.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath