chore: purge banned Nix tooling + dependabot accuracy (#36)

Part of the a2ml-validate-action hygiene pass. Removes Nix (banned
estate-wide; Guix only) from active tooling and corrects the
template-cruft dependabot config.

## Removed
- `flake.nix`
- `.envrc` nix-flake activation block
- `Justfile` `nix-shell` recipe
- `.machine_readable/scripts/lifecycle/install-tools.sh` nix branch →
now **guix-first**, then asdf
- `.gitattributes` `*.nix` / `flake.lock` rules
- `.gitignore` Nix / `flake.lock` section
- `.editorconfig` `[*.nix]` block

## Dependabot
Trimmed to **github-actions only**. The repo ships no language manifests
(no Cargo.toml/mix.exs/package.json), and `nix`/`pip`(Python)/`npm`
ecosystems are banned estate-wide. Also drops the `cargo` `ignore:
semver-patch` anti-pattern inherited from the template.

## Deliberately NOT included (need owner decisions / manual pass)
- **`.github/CONTRIBUTING.md`** — broken template residue (wrong clone
URL, malformed, stale names) that GitHub serves over the clean root
`CONTRIBUTING.md`. Needs a dedup decision, not a one-line patch.
- Root **`CONTRIBUTING.md`** `nix develop` line — file lacks the
owner-attribution string the pre-commit hook requires, so editing it is
part of your manual licence/header pass.
- **Doc mentions** of Nix that describe it as an external/standard
option (`docs/RSR_OUTLINE.adoc` Tier-2 list,
`docs/STATE-VISUALIZER.adoc` diagram).
- **`.machine_readable/`** Nix references — part of the separate
machine-readable restructure.

Signed; no licence/SPDX header edits.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.editorconfig

@@ -56,9 +56,6 @@ indent_size = 2
 [*.scm]
 indent_size = 2
 
-[*.nix]
-indent_size = 2
-
 [Justfile]
 indent_style = space
 indent_size = 4

.envrc

@@ -12,11 +12,6 @@ if has guix && [ -f guix.scm ]; then
   use guix
 fi
 
-# Load Nix flake if flake.nix exists
-if has nix && [ -f flake.nix ]; then
-  use flake
-fi
-
 # Project environment variables
 export PROJECT_NAME="a2ml-validate-action"
 export RSR_TIER="infrastructure"

.gitattributes

@@ -18,7 +18,6 @@
 *.scm   text eol=lf
 *.a2ml  text eol=lf linguist-language=TOML
 *.ncl   text eol=lf
-*.nix   text eol=lf
 
 # Docs
 *.md    text eol=lf diff=markdown
@@ -52,4 +51,3 @@ Containerfile  text eol=lf
 
 # Lock files
 Cargo.lock  text eol=lf -diff
-flake.lock  text eol=lf -diff

.github/dependabot.yml

@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: MPL-2.0
 # Dependabot configuration for RSR-compliant repositories
-# Covers common ecosystems - remove unused ones for your project
+# Only github-actions is enabled: this repo ships no language manifests
+# (no Cargo.toml/mix.exs/etc.), and Nix/Python(pip)/npm are banned estate-wide.
 
 version: 2
 updates:
@@ -13,36 +14,3 @@ updates:
       actions:
         patterns:
           - "*"
-
-  # Rust/Cargo
-  - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    ignore:
-      - dependency-name: "*"
-        update-types: ["version-update:semver-patch"]
-
-  # Elixir/Mix
-  - package-ecosystem: "mix"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Node.js/npm
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Python/pip
-  - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Nix flakes
-  - package-ecosystem: "nix"
-    directory: "/"
-    schedule:
-      interval: "weekly"

.gitignore

@@ -52,12 +52,6 @@ __pycache__/
 /obj/
 /bin/
 
-# Nix
-# flake.lock is ignored in the template repo because each project should
-# generate its own lock file on first use. In derived projects, REMOVE this
-# line and track flake.lock for reproducible builds.
-flake.lock
-
 # Haskell
 /.stack-work/
 /dist-newstyle/

.machine_readable/scripts/lifecycle/install-tools.sh

@@ -3,15 +3,15 @@
 #
 # install-tools.sh — Developer toolchain installer
 #
-# Detects and installs the required project toolchain (asdf, nix, or guix).
+# Detects and installs the required project toolchain (guix or asdf).
 
 set -euo pipefail
 
 echo "=== RSR Toolchain Installer ==="
 
-if [ -f "flake.nix" ] && command -v nix &>/dev/null; then
-    echo "Nix detected. Setting up development shell..."
-    nix develop --command echo "Nix shell verified."
+if [ -f "guix.scm" ] && command -v guix &>/dev/null; then
+    echo "Guix detected. Setting up development environment..."
+    guix shell -D -f guix.scm -- echo "Guix environment verified."
 elif [ -f ".tool-versions" ] && command -v asdf &>/dev/null; then
     echo "asdf detected. Installing plugins and tools..."
     while read -r line; do
@@ -20,7 +20,7 @@ elif [ -f ".tool-versions" ] && command -v asdf &>/dev/null; then
     done < .tool-versions
     asdf install
 else
-    echo "No standard toolchain (Nix/asdf) detected or installed."
+    echo "No standard toolchain (guix/asdf) detected or installed."
     echo "Please refer to README.adoc for manual setup instructions."
 fi
 

Justfile

@@ -800,10 +800,6 @@ guix-shell:
 guix-build:
     guix build -f guix.scm
 
-# Enter Nix development shell (fallback)
-nix-shell:
-    @if [ -f "flake.nix" ]; then nix develop; else echo "No flake.nix"; fi
-
 # ═══════════════════════════════════════════════════════════════════════════════
 # HYBRID AUTOMATION
 # ═══════════════════════════════════════════════════════════════════════════════