feat(admin-config-tool): task 1.3 - nix and xce-build.sh integration

Add python3 + pycapnp/pyyaml/jsonschema/click/pytest/ruff (+pip) to the
nix dev shell, wire a new `xceadmin` case into xce-build.sh (schema
sync from src/schema/ and src/configs/schema/, pip install by profile,
pytest), package-data config so bundled schemas survive a non-editable
install, xce-build SKILL.md docs, and ruff format/check hooks matching
this repo's stdin-JSON hook convention (not brief.md's env-var sketch,
which would have silently no-op'd).

Verified live end-to-end inside `nix develop ./src` for both the
default (editable) and release (pinned) profiles; found and fixed 3
real bugs along the way (missing pip, PEP 668 externally-managed-
environment, missing package-data for release-profile bundling) —
logged as bug-1458/1459/1460.

Requirements: 5.5, 8.1, 8.2, 8.6

src/nixSupport/xce.nix

@@ -61,6 +61,18 @@ stdenv.mkDerivation {
     }))
     packcc
     cacert
+    # Python — for xceadmin (admin config tool, src/xceadmin/). pycapnp links
+    # against the capnproto C++ runtime above; nix's python3Packages.pycapnp
+    # handles that link correctly, unlike a plain `pip install pycapnp`.
+    # See .kiro/specs/admin-config-tool/brief.md "Nix Environment".
+    python3
+    python3Packages.pip
+    python3Packages.pycapnp
+    python3Packages.pyyaml
+    python3Packages.jsonschema
+    python3Packages.click
+    python3Packages.pytest
+    python3Packages.ruff
   ]  ++ (if withDebug then [
     (librtti_debug.overrideAttrs (oldattrs: {
       separateDebugInfo = true;

src/tools/xce-build.sh

@@ -49,7 +49,7 @@ cd "$SRC_DIR"
 
 usage() {
     echo "Usage: $0 [component] [profile|build_dir] [build_dir]"
-    echo "Components: all (default), lib, controller, scheduler, worker, apiserver, xcecli"
+    echo "Components: all (default), lib, controller, scheduler, worker, apiserver, xcecli, xceadmin"
     echo "Profiles:   asan (default), debug (non-ASAN -O0 -g3, for gdb/cores), release"
     exit 1
 }
@@ -112,6 +112,43 @@ case "$COMPONENT" in
             cd frontend/xcecli && CGO_ENABLED=0 go test ./... -count=1
         fi
         ;;
+    xceadmin)
+        # Python — no meson, dispatched by this case statement alone (design
+        # review correction: xceadmin is deliberately NOT wired into
+        # src/meson.build/meson.options, see .kiro/specs/admin-config-tool/
+        # design.md, File Structure Plan). Ignores $BUILD_DIR/$MESON_OPTS;
+        # $PROFILE only selects editable vs. pinned pip install below.
+        XCEADMIN_DIR="$SRC_DIR/xceadmin"
+        SCHEMA_DST="$XCEADMIN_DIR/src/xcecommon/schema_files"
+        echo "=== Syncing xceadmin bundled schemas ==="
+        mkdir -p "$SCHEMA_DST/json"
+        cp "$SRC_DIR/schema/controller.capnp" "$SCHEMA_DST/controller.capnp"
+        cp "$SRC_DIR/schema/c.capnp" "$SCHEMA_DST/c.capnp"
+        cp "$SRC_DIR/configs/schema/"*.schema.json "$SCHEMA_DST/json/"
+        cd "$XCEADMIN_DIR"
+        # nix's python3 site-packages lives under the read-only /nix/store,
+        # so `pip install` (editable or pinned) can't target it directly —
+        # it refuses with "externally-managed-environment" (PEP 668). Use a
+        # throwaway venv that inherits the nix-provided pycapnp/pyyaml/
+        # jsonschema/click/pytest (--system-site-packages) so pip only ever
+        # has to install xceadmin itself, never rebuild those from PyPI.
+        # Recreated on every invocation for a clean, reproducible install —
+        # same philosophy as setup_build's `rm -rf "$BUILD_DIR"` above.
+        VENV_DIR="$XCEADMIN_DIR/.venv"
+        rm -rf "$VENV_DIR"
+        python3 -m venv --system-site-packages "$VENV_DIR"
+        if [ "$PROFILE" = "release" ]; then
+            echo "=== Building xceadmin Python package (pinned, non-editable) ==="
+            "$VENV_DIR/bin/pip" install . --quiet
+        else
+            echo "=== Building xceadmin Python package (editable) ==="
+            "$VENV_DIR/bin/pip" install -e . --quiet
+        fi
+        echo "=== Running xceadmin tests ==="
+        "$VENV_DIR/bin/python" -m pytest tests/ -v
+        echo "=== Done: xceadmin (profile=$PROFILE) ==="
+        exit 0
+        ;;
     all)
         setup_build
         echo "=== Building all components ==="

src/xceadmin/.gitignore

@@ -0,0 +1,12 @@
+# Build artifacts
+build/
+*.egg-info/
+__pycache__/
+*.pyc
+.pytest_cache/
+.venv/
+.ruff_cache/
+
+# Synced package data — regenerated from src/schema/ and src/configs/schema/
+# by `xce-build.sh xceadmin`'s schema-sync step; never hand-edited, never committed.
+src/xcecommon/schema_files/

src/xceadmin/pyproject.toml

@@ -27,3 +27,12 @@ include = ["xceadmin*", "xcecommon*"]
 
 [tool.setuptools.package-dir]
 "" = "src"
+
+# Bundled copies of controller.capnp/c.capnp and the 7 JSON validation
+# schemas (synced from src/schema/ and src/configs/schema/ by
+# src/tools/xce-build.sh's `xceadmin)` case, see Requirement 5.5). Without
+# this, a non-editable `pip install .` builds a wheel containing only *.py
+# files and silently drops schema_files/ — an editable install would never
+# catch this since it resolves straight into the checked-out source tree.
+[tool.setuptools.package-data]
+xcecommon = ["schema_files/*.capnp", "schema_files/json/*.schema.json"]