chore(packaging): Guix-only — remove flake.nix, add a real guix.scm (#211)

chore(packaging): Guix-only — remove flake.nix, add a real guix.scm

The estate retired the Nix fallback on 2026-05-18. `flake.nix` was
nonetheless
added to this repo on 2026-07-21 by #187, i.e. *after* the ruling, and
`guix.scm`
has never existed here — so verisimdb has been carrying the retired tier
and
none of the current one.

It is also the repo's lone `SupplyChain` finding: `panic-attack assail`
flags
`flake.nix` for declaring inputs without `narHash` and having no sibling
`flake.lock`. The packaging-policy question and the security finding are
the
same file, which is unusually tidy.

**What is lost: nothing.** `flake.nix` was a dev shell, not a package
build, and
said so in its own header — it declared `just cargo rustc rustfmt
clippy`. The
new `guix.scm` is the one-for-one replacement (`guix shell -m guix.scm`)
and
covers strictly more: it adds `elixir`/`erlang` for
`elixir-orchestration/`,
`coq` for the nine modules gated by `coq-build.yml`, and `reuse` for the
compliance check — all things this repo actually uses and the flake
omitted.

Two deliberate choices, both stated in the file header so nobody has to
reverse-engineer them:

**It is a manifest, not a `(package ...)` with `cargo-build-system`.** A
correct
`#:cargo-inputs` for a 17-crate workspace needs every transitive crate
pinned.
A definition that looked like a package build while failing to produce
one would
be worse than an honest manifest — this estate already has enough
artefacts that
satisfy a presence check without doing anything. Promote it when someone
can
build and verify it end to end.

**It is NOT written from a template, and that matters here.** Guix is
not
installed on this machine, so I could not evaluate the file; the header
says so
rather than implying it was tested. I also checked the obvious shortcut
— the
existing estate `guix.scm` files — and did not use them, because they
are
corrupt. `meta-repos/burble`, `meta-repos/gossamer` and
`meta-repos/paint-type`
carry a **byte-identical 18-line file** declaring:

    (name "squisher-corpus")
    (home-page "https://github.com/hyperpolymath/squisher-corpus")
    (license ... "PMPL-1.0-or-later" ...)

Three unrelated projects, all claiming to be squisher-corpus, all under
Palimpsest rather than their own licence. That is the known clobber
incident,
still live in at least those three. Copying one here would have imported
a wrong
identity and a wrong licence into a repo whose `META.a2ml` AD-006
explicitly
records "MPL-2.0 across the workspace (no AGPL)".

`docs/rsr-compliance.adoc:164` still lists "`guix.scm` OR `flake.nix`"
and is
left alone — it describes the RSR standard's requirement, which this
change
satisfies, and rewriting a description of an external standard is not
mine to do
unilaterally.

Verified: `reuse lint` 775/775 compliant; no remaining
`flake.nix`/`flake.lock`
reference anywhere except the rsr-compliance line above.

**Needs a follow-up run:** `guix shell -m guix.scm -- true` on a machine
with
Guix, to confirm every specification name resolves. If one has drifted,
fix the
name — do not delete the file.

Author: hyperpolymath

flake.nix

@@ -0,0 +1,53 @@
+;; SPDX-License-Identifier: MPL-2.0
+;; SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+;;
+;; Guix development manifest for VeriSimDB.
+;;
+;;     guix shell -m guix.scm
+;;
+;; SCOPE — read this before extending the file.
+;;
+;; This is a *development environment* manifest, not a package definition. It
+;; replaces the `flake.nix` dev shell removed in the same change, one-for-one:
+;; that file declared a toolchain, not a build, and said so in its own header.
+;; Nothing that existed before is lost by this swap.
+;;
+;; It is deliberately NOT a `(package ...)` with `cargo-build-system`. VeriSimDB
+;; is a 17-crate Rust workspace plus an Elixir/OTP layer; a correct
+;; `#:cargo-inputs` enumeration would need every transitive crate pinned, and a
+;; definition that merely *looks* like a package build while failing to produce
+;; one would be worse than this honest manifest — the estate already has enough
+;; artefacts that satisfy a presence check without doing anything. Promote this
+;; to a real package definition when someone can build and verify it end to end.
+;;
+;; NOT VALIDATED LOCALLY: Guix is not installed on the authoring machine, so
+;; this file has not been evaluated. Run `guix shell -m guix.scm -- true` before
+;; relying on it, and fix rather than delete it if a specification name has
+;; drifted.
+;;
+;; Toolchain rationale — each entry maps to something this repo actually uses:
+;;
+;;   rust, rust:cargo   17-crate workspace under rust-core/ (Cargo.toml)
+;;   rust:rustfmt       `cargo fmt` is enforced in CI
+;;   elixir, erlang     elixir-orchestration/ (mix, 647 tests)
+;;   coq                formal/ — 9 modules, gated by coq-build.yml
+;;   just               formal/Justfile and the root justfile
+;;   reuse              REUSE compliance is a required check (776/776)
+;;   git, gnu-make      assumed by several recipes
+;;
+;; Deliberately absent: Node, npm, Deno and friends. This repo's own
+;; NPM/Bun Blocker and TypeScript/JavaScript Blocker workflows reject them, and
+;; a template-supplied toolchain that installed them is exactly the class of
+;; drift those gates exist to catch.
+
+(specifications->manifest
+ (list "rust"
+       "rust:cargo"
+       "rust:rustfmt"
+       "elixir"
+       "erlang"
+       "coq"
+       "just"
+       "reuse"
+       "git"
+       "gnu-make"))