chore(build): migrate Rust validation tasks to Nix

[elezar]

Summary

Make Nix a documented OpenShell development prerequisite and make the flake the canonical source for Rust validation commands. Mise remains the cross-platform task interface and keeps the native Windows implementations.

Related Issue

No issue required: this is a localized build and CI workflow consolidation with no product behavior change.

Changes

• add Nix apps for Cargo lockfile validation, checking, formatting, linting, dependency policy, and tests
• route the corresponding mise tasks and Branch Checks jobs through the shared Nix apps
• include e2fsprogs in the Rust test app for VM-driver unit tests
• document Nix installation and the mise-to-Nix task mapping for contributors
• document the division of responsibility between Nix and mise in the build architecture

Testing

• mise run pre-commit passes
• nix flake check --no-build --all-systems passes
• nix run .#rust-format-check passes
• mise run rust:lockfiles:check passes
• nix run .#rust-check passes
• nix run .#rust-lint passes
• nix run .#rust-deny-policy passes
• Actionlint passes for .github/workflows/branch-checks.yml
• Full nix run .#rust-test: 6,797 of 6,799 workspace tests pass locally; two existing openshell-driver-vm tracing tests time out on macOS both in the app and when run alone through nix develop
• The content-guard nextest profile passes separately (16 tests)
• Unit tests added/updated (command migration only)
• E2E tests added/updated (not applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated

[github-actions]

This pull request has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity.