fix(root-shape): allowlist flake.nix pending the Nix-retirement decision

The root-shape gate failed on flake.nix. Nix was retired estate-wide on
2026-06-01, but REMOVING the file is a policy decision (backlog §A), not
something a CI-unblocking PR should make -- campaign #102 hand-diffed 277
candidates and removed exactly 1, so fan-out REMOVE verdicts over-call here.

Allowlisted with an explicit TOLERATED-NOT-BLESSED comment so the decision is
recorded rather than silently made.

Verified locally: check-root-shape.sh exits 0 clean, and still exits 1 when a
probe file is added at root -- the gate can still fail.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/root-allow.txt

@@ -65,3 +65,12 @@ container/                 # may host Containerfile if not at build/
 .pre-commit-config.yaml    # TODO: relocate to ci/.pre-commit-config.yaml after invocation pattern decided
 affinescript/              # AffineScript source subtree consumed by this template
 tools/                     # TODO: consolidate with scripts/ or document the split (pending decision)
+
+# ─── Nix retirement (policy item, not a CI fix) ───────────────────────────────
+flake.nix                  # TOLERATED, NOT BLESSED. Nix was retired estate-wide on
+                           # 2026-06-01 (Guix primary + sealed-container escape hatch).
+                           # This entry stops the root-shape gate failing on a file whose
+                           # REMOVAL is a policy decision tracked in
+                           # dev-notes/GOVERNANCE-REMEDIATION-BACKLOG.md §A — not something
+                           # a CI-unblocking PR should decide. Do NOT mass-delete: campaign
+                           # #102 hand-diffed 277 candidates and removed exactly 1.