docs(flake): annotate KEEP+DEP rationale per standards#102 rule 3 (#12)

Per the campaign gate, this flake is LOAD-BEARING — guix.scm uses
cargo-build-system with no named inputs (cargo vendors everything);
the sealed Containerfile installs only `rust cargo`. This flake's
devShell is the sole source of the rust-overlay rustToolchain and
the Rust dev-tool surface (cargo-watch, cargo-edit, cargo-audit,
cargo-deny, cargo-fuzz), plus the RSR-template common tools (git,
just, nickel, curl, bash, coreutils).

Refs standards#101 standards#102.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

flake.nix

@@ -7,6 +7,15 @@
 # as a FALLBACK for contributors who use Nix instead of Guix. The .envrc checks
 # for Guix first, then falls back to Nix.
 #
+# Retained per standards#102 rule 3 (KEEP+DEP). guix.scm uses
+# cargo-build-system with NO named inputs (cargo vendors everything);
+# the sealed Containerfile installs only `rust cargo`. This flake's
+# devShell is the SOLE source of the rust-overlay rustToolchain and
+# the Rust dev-tool surface: cargo-watch, cargo-edit, cargo-audit,
+# cargo-deny, cargo-fuzz — plus the RSR-template common tools (git,
+# just, nickel, curl, bash, coreutils). Remove only once those are
+# reachable via Guix or the sealed container.
+#
 # Usage:
 #   nix develop          # Enter development shell
 #   nix build            # Build the project