flake: replace naersk with crane (#538)

Framework swap, no public API change.

- naersk input → crane (`github:ipetkov/crane`); crane is stateless, no
  nixpkgs.follows needed.
- `forAllSystems` exposes `craneLib = crane.mkLib pkgs`,
  `cargoArtifacts = craneLib.buildDepsOnly` (built once, reused), and
  a shared `nativeBuildInputs = [ pkgs.librsvg pkgs.git ]` consumed by
  buildDepsOnly + buildPackage + cargoClippy so the three derivations
  see the same toolchain shape.
- `packages.default = craneLib.buildPackage` (was naersk-lib.buildPackage)
  with explicit `pname = "hyperhive-workspace"; version = "0.1.0";` —
  the virtual workspace Cargo.toml has no [package].name so crane
  needs the hint.
- `checks.clippy = craneLib.cargoClippy` (was naersk + overrideAttrs
  hack). Crane parses `cargoClippyExtraArgs = "--workspace --all-targets
  -- -D warnings"` correctly; naersk's `mode = "clippy"` used to mangle
  the `--` separator which is why the old wiring went through
  overrideAttrs. The whole hack — including `doCheck = false`,
  `copyTarget = false`, and the swapped buildPhase/installPhase — is
  now gone.
- librsvg native dep (#424) preserved on all three derivations. Added
  pkgs.git too — naersk auto-included it; crane is more minimal, so
  hive-c0re's `lifecycle::tests::setup_proposed_*` (which shell out to
  `git init`+commit) need it explicit to pass under `cargo test` in
  the sandbox.
- build.rs + hive-c0re/Cargo.toml comments updated from "naersk
  derivation" to "crane derivation".
- 3 doc-list-indentation lints in hive-sh4re/src/lib.rs cleaned up
  (replaced `+`-at-line-start with `and`/`/` so doc continuations
  don't trigger `clippy::doc_lazy_continuation`).

Validated locally: `nix build .#default --fallback` succeeds, all
117 tests pass, all four bins in `result/bin/`.

hive-sh4re/src/lib.rs

@@ -23,8 +23,8 @@ pub enum HostRequest {
     /// `hive-c0re request-spawn` CLI both go through this. The
     /// previously-mirrored manager-side `RequestSpawn` was removed
     /// (#442) — managers now go through the two-step `request_init_config`
-    /// + `request_apply_commit` flow so the spawn captures the manager's
-    /// customised config.
+    /// and `request_apply_commit` flow so the spawn captures the
+    /// manager's customised config.
     RequestSpawn { name: String },
     /// Stop a managed container (graceful).
     Kill { name: String },
@@ -957,8 +957,8 @@ pub enum ManagerRequest {
     /// per-target fan-out once immediately without touching
     /// `next_fire_at_unix` on recurring schedules; one-shots are
     /// consumed by the manual fire. Authorization mirrors
-    /// `CancelSchedule`: the manager can fire its own schedules
-    /// + any owned by a sub-agent in its subtree per topology.json;
+    /// `CancelSchedule`: the manager can fire its own schedules and
+    /// any owned by a sub-agent in its subtree per topology.json;
     /// the operator surface bypasses the check.
     FireScheduleNow { id: i64 },
     /// Edit an existing schedule's mutable fields (#474). Partial
@@ -1013,9 +1013,9 @@ pub struct SchedulePromptPayload {
 }
 
 /// Schedule row shape on the wire — mirror of
-/// `scheduled_prompts::Schedule` but in the public crate so dashboard
-/// + agent surfaces can deserialize without depending on
-/// hive-c0re-internal types. Kept structurally identical to the
+/// `scheduled_prompts::Schedule` but in the public crate so the
+/// dashboard and agent surfaces can deserialize without depending
+/// on hive-c0re-internal types. Kept structurally identical to the
 /// in-process type; the conversion is field-by-field in
 /// `manager_server` / `dashboard`.
 #[derive(Debug, Clone, Serialize, Deserialize)]