feat: add tack lockfile backend

[xfo-0]

Adds a tack lockfile backend: flake-like TOML pins, lazily fetched, no flake.lock.

• flakeModules.tack (modules/tack/): renders flake-file.inputs into .tack/pins.toml; write-tack copies the pins and runs tack update to produce .tack/pins.lock.json. Nix reads the lock through the tack resolver — pins.toml only drives updates. Wired into write-lock dispatch.
• Input schema extension scoped to the module: tackType (flake/fetch/fixed) and unpack (tarball/file) declared via submodule option merge, re-merged after preProcess since inputsExpr strips unknown fields — they never leak into generated flake.nix.
• Config via flake-file.tack.*: package, lock dir/file names, [shorturls], [all_follow], recomposability, resolver overrides (read-only flake-file.tack.sources).
• templates/tack: lock-less flake; entrypoint is a lazy __functor threading tackOverrides + real self.outPath.
• Tests: 15 nix-unit serializer cases (suite 264/264) + bootstrap tests (test-tack, test-write-lock-tack).
• CI: template excluded from the generic matrix (lock-less — --override-input can't reach it; vendored lock pins upstream, not the PR SHA). Dedicated label-gated tack job builds the template's write-tack against the PR checkout via tackOverrides, runs it, asserts no pins.toml drift, builds the devShell. Apply the tack label to run it.
• Default package: pkgs.tack when present, else built from a pinned tack source tarball (nix/package.nix, cargoLock).

Review notes: write-tack needs network + a tack binary; serializer emits type = "fetch" for flake = false (tack's documented legacy mapping), explicit tackType wins.

🤖 Generated with Claude Code

[vic]

Hey @xfo-0, this looks great! let's wait for CI to finish and we merge. PR looks good.

Would you be interested in sending a tack PR for denful/with-inputs ? Those do not depend on flake-file but are kinda the "other-part" (loading flake-likes from tack) that would be needed.

[vic]

I removed nixlock support (CI was unable to download the archive for it).

Now bootstrap tests fail:
https://github.com/denful/flake-file/actions/runs/27374245102/job/80894266538#step:6:308

Can you add bootstrap tests for tack and provide a default tack pkg (if not available from nixpkgs, use fetchtarball from their url)

See how the github action runs bootstrap tests so you can check locally

[xfo-0]

Done in 467b11f (superseded by 3b430da):

• default package: pkgs.tack or pkgs.callPackage on a pinned tack source tarball (nix/package.nix uses cargoLock — no hash churn). The throwing default broke bootstrap eval through write-lock's app aggregation.
• tests: test-tack (write-tack end to end), test-write-lock-tack (lock dispatch). Bootstrap job exports GITHUB_TOKEN — tack resolves refs via api.github.com, anonymous limits flake on shared runners.
• drive-by: npins seed bumped to version 8 — current npins rejects v7 ("too old") and write-npins exits 0 on that error, failing test-write-lock-npins independently of tack.

Local suite: 13/13.

[vic]

Please remove bootstrap-tests/test-* directories, gitignore them, they are generated by tests and are not needed in repo.

[xfo-0]

Pushed 3b430da + dcf8171:

• bootstrap-tests/test-* artifacts removed from history; /bootstrap-tests/ and /dev/flake.lock gitignored (both regenerate).
• fmt failure was the artifacts (on-unmatched = fatal) plus nixf-diagnose rewriting builtins.fetchTarball → fetchTarball; nix run ./dev#fmt -- --ci now clean locally.
• review sweep: nixlock references lingered in seven docs pages after f17f281 — cleaned up, write-tack added to the bootstrap reference.

Diff vs f17f281 is exactly: workflow token env, .gitignore, the two tests, the default package, docs cleanup.

[vic]

• /dev/flake.lock gitignored

See CI failure:

   > FileNotFoundError: [Errno 2] No such file or directory: '/nix/store/ihl403qikkqwzygfrzkvjhdrgm0zyir6-source/dev/flake.lock'

flake.lock is needed on dev flake.

[xfo-0]

Restored dev/flake.lock (f17f281 removed it; check-flake-file reads the committed lock) and dropped it from .gitignore. cd dev && nix flake check passes locally.

[vic]

Awesome! thank you so much, @xfo-0 !