docs(flake): annotate KEEP+DEP rationale (standards#102)

flake.nix

@@ -7,6 +7,15 @@
 # as a FALLBACK for contributors who use Nix instead of Guix. The .envrc checks
 # for Guix first, then falls back to Nix.
 #
+# Retained per standards#102 rule 3 (KEEP+DEP). guix.scm uses
+# cargo-build-system with NO named inputs (cargo vendors everything);
+# the sealed Containerfile installs only `rust cargo`. This flake's
+# devShell is the SOLE source of the rust-overlay rustToolchain and
+# the Rust dev-tool surface: cargo-watch, cargo-edit, cargo-audit,
+# cargo-deny, cargo-fuzz — plus the RSR-template common tools (git,
+# just, nickel, curl, bash, coreutils). Remove only once those are
+# reachable via Guix or the sealed container.
+#
 # Usage:
 #   nix develop          # Enter development shell
 #   nix build            # Build the project