fix(pkg): retire Nix-mirror per Guix-primary ruling (standards#101) (#289)

Refs standards#101 standards#102. Refs not Closes — this PR does not
close any issue.

## What

Retire the Nix-mirror in hypatia. Guix-primary + sealed-container-escape
is the canonical packaging policy per
[standards#101](hyperpolymath/standards#101);
the Nix-mirror was a hand-mirrored twin retired estate-wide.

## Verified pure mirror (the standards#102 gate)

`guix.scm` covers the entire flake devShell dep set verbatim:

| flake devShell buildInput | guix.scm native-input |
|---|---|
| elixir | elixir |
| erlang | erlang |
| rustc + cargo + clippy + rustfmt | rust + rust-cargo |
| idris2 | idris2 |
| zig | zig |
| pkg-config | pkg-config |
| openssl | openssl |

Every flake dep is mirrored — pure mirror per the campaign gate (`flake
vs Guix ∪ sealed-container`). `guix.scm`'s `(source #f)` is the standard
dev-shell form (paired with a real `native-inputs` list); not the
disqualifying empty-stub form. `guix shell -D -f guix.scm` is the direct
replacement for `nix develop`.

## Changes

- `git rm flake.nix flake.lock`
- `CONTRIBUTING.md` §Getting Started: `nix develop` → `guix shell -D -f
guix.scm` (links standards#101).
- `TESTING-AUDIT.md` Reproducibility row: dereferences `flake.nix`
(canonical = `guix.scm`).
- Historical audit reports (`docs/reports/audit/`,
`docs/governance/CRG-AUDIT-2026-04-18.adoc`) retain their `flake.nix`
references as dated snapshots — not edited.

## Campaign context

Estate-wide verification (Waves 1–14, ~280 in-scope repos) found that
**hypatia is the single genuine pure-mirror in the campaign so far**.
Most other repos have scaffold-stub `guix.scm` (KEEP+FLAG) or
load-bearing flake-only dev tooling (KEEP+DEP). Personally re-verified
against the agent-flagged candidates (proof-of-work and tma-mark2 were
over-called; hypatia stood up).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

CONTRIBUTING.md

@@ -15,7 +15,7 @@ We welcome contributions in many forms:
 ## Getting Started
 
 1. **Read the AI Manifest:** Start with `0-AI-MANIFEST.a2ml` (if present) to understand the repository structure.
-2. **Environment:** Use `nix develop` or `direnv allow` to set up your tools.
+2. **Environment:** Use `guix shell -D -f guix.scm` (or `direnv allow`) to set up your tools. Guix is the canonical packager per [standards#101](https://github.com/hyperpolymath/standards/issues/101); the prior `nix develop` fallback was retired.
 3. **Task Runner:** Use `just` to see available commands (`just --list`).
 
 ## Development Workflow

TESTING-AUDIT.md

@@ -98,7 +98,7 @@ baseline, add a CI job that fails if p95 regresses > 50%.
 | **Functionality** | strong | 39 Elixir + 38 Rust test files, ~8,659 Elixir LOC, full pipeline E2E |
 | **Versability** | strong | SemVer in `CHANGELOG.adoc` + `mix.exs`, detailed per-version changelogs |
 | **Maintainability** | strong | Modular Rust workspace, TOPOLOGY.md, DESIGN-NARRATIVE.md, clean module boundaries |
-| **Reproducibility** | strong | `flake.nix` + `guix.scm`, `Cargo.lock` + `mix.lock` committed |
+| **Reproducibility** | strong | `guix.scm` (canonical per standards#101 — `flake.nix` retired), `Cargo.lock` + `mix.lock` committed |
 | **Portability** | strong | Cross-platform CI matrix (Linux x86_64 / ARM64, macOS x86_64 / ARM64, Windows), Containerfile, podman |
 | **Dependability** | weak | OTP supervision + concurrency tests but no chaos engineering, no fault-injection |
 | **Performance** | weak | No published metrics, no latency / throughput benchmarks gated, no capacity planning |