refactor: slim flake.nix into nix/ entry files

nix/checks.nix

@@ -0,0 +1,87 @@
+# Flake checks: formatting, the clippy gate, the workspace test run,
+# the nix-options docs eval, and the hivectl CLI-reference freshness
+# check. Imported per system from flake.nix.
+{
+  pkgs,
+  craneLib,
+  rust,
+  self,
+  system,
+  treefmt-eval,
+}:
+let
+  inherit (rust) cleanSrc cargoArtifacts nativeBuildInputs;
+in
+{
+  formatting = treefmt-eval.config.build.check self;
+
+  # Clippy via crane's first-class `cargoClippy` builder. Reuses the
+  # shared `cargoArtifacts` (deps already built) and runs
+  # `cargo clippy --workspace --all-targets` directly.
+  #
+  # `-D warnings` makes the default/correctness/style lints a
+  # hard CI gate. `-A clippy::pedantic` then drops the pedantic
+  # group from that gate: pedantic is the "extra, opinionated"
+  # group the clippy team grows freely, so denying it means
+  # every toolchain bump that adds a new pedantic lint breaks CI
+  # with zero code changes. The `pedantic = warn`
+  # workspace lint (Cargo.toml) keeps it as advisory signal in
+  # local `cargo clippy` — it just no longer blocks the build.
+  # (`-A` rather than `-W` here: `-W clippy::pedantic` would
+  # re-enable the specific pedantic lints the workspace lints
+  # table allows, e.g. `must_use_candidate`.)
+  clippy = craneLib.cargoClippy {
+    src = cleanSrc;
+    inherit cargoArtifacts nativeBuildInputs;
+    pname = "hyperhive-workspace";
+    version = "0.1.0";
+    cargoClippyExtraArgs = "--workspace --all-targets -- -D warnings";
+  };
+
+  # `cargo test --workspace` lifted out of the package builds so the
+  # `hyperhive-assets` dep (which `hive-ag3nt::prompt::tests`
+  # needs via `HIVE_ASSETS_DIR` to assert against the actual
+  # production prompt template) is scoped to this one check
+  # instead of bleeding into the binary derivations' input
+  # hash. Net: editing `hive-ag3nt/prompts/system.md` still
+  # rebuilds this test check (correct — the tests assert
+  # against its wording), but `packages.default` and the
+  # per-container toplevels stay fully cached.
+  cargo-test = craneLib.cargoTest {
+    src = cleanSrc;
+    inherit cargoArtifacts nativeBuildInputs;
+    pname = "hyperhive-workspace";
+    version = "0.1.0";
+    cargoTestExtraArgs = "--workspace";
+    HIVE_ASSETS_DIR = "${self.packages.${system}.assets}/share/hyperhive";
+  };
+
+  # Nix options docs evaluation. Cheap: pulls in `nixosOptionsDoc` +
+  # the host module's stub eval, no rust or frontend deps. CI fails
+  # fast if a module change breaks option declarations or the doc
+  # rendering. Reuses the `packages.<system>.docs` derivation so the
+  # per-system eval of nix/docs/default.nix happens once.
+  inherit (self.packages.${system}) docs;
+
+  # `hivectl` CLI reference freshness check. The committed
+  # markdown at `docs/tools/hivectl-cli.md` is the rendered
+  # output of the hidden `hivectl markdown-docs` subcommand
+  # (clap-markdown walks the binary's own command tree). This
+  # check regenerates it from the built binary and fails if the
+  # committed copy drifted — so a verb / flag / help-string edit
+  # that forgets to refresh the doc is caught in CI. Reuses the
+  # already-built `packages.<system>.default` (no extra compile).
+  # Regenerate locally with:
+  #   nix build .#default
+  #   ./result/bin/hivectl markdown-docs > docs/tools/hivectl-cli.md
+  hivectl-docs = pkgs.runCommand "hivectl-docs-fresh" { nativeBuildInputs = [ pkgs.diffutils ]; } ''
+    ${self.packages.${system}.default}/bin/hivectl markdown-docs > generated.md
+    if ! diff -u ${../docs/tools/hivectl-cli.md} generated.md; then
+      echo "" >&2
+      echo "ERROR: docs/tools/hivectl-cli.md is out of date — regenerate it:" >&2
+      echo "  nix build .#default && ./result/bin/hivectl markdown-docs > docs/tools/hivectl-cli.md" >&2
+      exit 1
+    fi
+    touch "$out"
+  '';
+}