policy: Guix-only — retire "Nix fallback" from canon (Nix banned estate-wide)

[hyperpolymath]

Policy

Nix is banned estate-wide; Guix is the sole package manager (owner directive). The current guix-nix-policy workflow/check is named "Guix primary / Nix fallback" and its logic explicitly accepts Nix as a fallback (✅ Nix package management detected (fallback)) and suggests adding flake.nix. This contradicts the ban.

Do

• Restate the canonical policy as Guix-only, Nix-present → FAIL.
• Update the canonical guix-nix-policy workflow (templated estate-wide) so any *.nix/flake.* present fails the check; drop the "add flake.nix" suggestion; rename the step away from "Nix fallback".
• This is the policy source; the estate rollout/execution is tracked in reposystem (Nix-deletion sweep + policy-template propagation).

Context

Estate scan 2026-06-22: 66 repos carry Nix (138 flake.nix, 32 flake.lock, +11 .nix), 53 repos have a use flake block in .envrc, 13 CI files use Nix. See dev-notes/ Nix scan.

[hyperpolymath]

Verified complete on current main (2026-08-24). The canonical governance job is now Guix packaging policy (Nix retired) and invokes the real scripts/check-package-policy.sh gate. Its recorded policy is Guix primary plus the sealed-container escape hatch, explicitly says Nix is not a tier, never emits a Nix success claim, and blocks Nix-only packaging after the 2026-06-01 retirement cutoff. Regression evidence: scripts/tests/governance-gates-505-test.sh passes 22/22, including planted Guix-positive, Nix-only-negative, absent-packaging-negative, vendored-file-negative, malformed-cutoff, and large-tree/SIGPIPE cases. The source implementation landed through #101/#505/#513/#534/#557/#563; this older policy issue remained open after its acceptance criteria were superseded and completed.