feat(build-time-versioning): nix packages compute build time at build phase

First attempt used builtins.currentTime at flake-evaluation time -- this
broke the plain, documented `nix build .#xcecore_debug` command entirely
(pure-eval strips builtins.currentTime, requiring --impure) and produced
a raw epoch-seconds string instead of UTC ISO-8601. Caught by task-local
review (REJECTED, round 1) before merge.

Fixed by moving the computation into each derivation's own build phase:
a preConfigure hook in xce.nix/xcecli.nix runs `date -u` (stdenv's
bundled coreutils, unaffected by pure-eval) and appends -Dbuild_time= to
mesonFlagsArray, with a fail-loud guard against empty output. commit_id's
existing self.shortRev/self.dirtyShortRev eval-time mechanism is
untouched. Verified via nix eval (no --impure) and nix build reaching
configure with real values on both xcecore_debug and xcecli (round 2,
APPROVED).

Task 2.2/13 of build-time-versioning. Also corrects design.md/research.md,
which described the now-superseded builtins.currentTime approach.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/flake.nix

@@ -16,6 +16,19 @@
         if builtins.hasAttr "shortRev" self
         then self.shortRev
         else self.dirtyShortRev;
+      # NOTE (build-time-versioning task 2.2, remediation round): unlike
+      # myCommitId (a genuinely flake-level, eval-time concept sourced from
+      # self.shortRev/self.dirtyShortRev), the build timestamp is NOT
+      # computed here. An earlier attempt used `builtins.toString
+      # builtins.currentTime` at this exact spot -- but builtins.currentTime
+      # is stripped entirely under a flake's default pure evaluation
+      # ("error: attribute 'currentTime' missing"), so `nix build
+      # .#xcecore_debug` (no --impure, the documented canonical command)
+      # failed at evaluation. Fixed by moving the build-time computation
+      # into each derivation's own build phase instead (xce.nix/xcecli.nix
+      # `preConfigure`, via stdenv's bundled `date -u`) -- see those files.
+      # Nothing build-time-related needs to be threaded through the flake
+      # or nixSupport/default.nix any more; only myCommitId still does.
     in
       flake-utils.lib.eachSystem supportedSystems (
         system: let

src/nixSupport/default.nix

@@ -4,6 +4,12 @@
   ...
 }:
 let
+  # NOTE (build-time-versioning task 2.2, remediation round): build-time is
+  # no longer threaded through here -- it's computed inside each
+  # derivation's own build phase (xce.nix/xcecli.nix `preConfigure`), since
+  # builtins.currentTime is unavailable under flake pure-eval. Only
+  # myCommitId (a genuine eval-time/flake-level value) still needs to be
+  # passed down.
   xcecore = pkgs.callPackage ./xce.nix {
     inherit pkgs myCommitId;
     withDebug = false;

src/nixSupport/xce.nix

@@ -103,6 +103,27 @@ stdenv.mkDerivation {
 
   impureEnvVars = [ "HOME" ];
 
+  # build-time-versioning task 2.2 (remediation round): build_time is
+  # computed HERE, in the build phase, not at flake-evaluation time --
+  # builtins.currentTime is unavailable under flake pure-eval (see
+  # flake.nix's note), so `nix build .#xcecore_debug` with no --impure
+  # would fail at evaluation if it were used. `date` (stdenv's bundled
+  # coreutils) is always available inside the build sandbox regardless of
+  # pure-eval -- no --impure, no git, no network needed. Matches
+  # xce-build.sh's (task 2.1) exact ISO-8601 format. mesonConfigurePhase
+  # (nixpkgs meson setup-hook.sh) runs `runHook preConfigure` before it
+  # reads mesonFlags/mesonFlagsArray to build the `meson setup` command
+  # line, so appending to mesonFlagsArray here is picked up at configure
+  # time.
+  preConfigure = ''
+    buildTime="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+    if [ -z "$buildTime" ]; then
+      echo "xce.nix: date -u produced an empty build time -- the -Dbuild_time= meson option would not reach the binary" >&2
+      exit 1
+    fi
+    mesonFlagsArray+=("-Dbuild_time=$buildTime")
+  '';
+
   mesonFlags =[
     (lib.optional withDebug "--buildtype=debug")
     (lib.optional withAsan "-Db_sanitize=address")

src/nixSupport/xcecli.nix

@@ -25,6 +25,17 @@ stdenv.mkDerivation {
 
   impureEnvVars = [ "HOME" ];
 
+  # See xce.nix for why build_time is computed here (build phase) rather
+  # than at flake-evaluation time.
+  preConfigure = ''
+    buildTime="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+    if [ -z "$buildTime" ]; then
+      echo "xcecli.nix: date -u produced an empty build time -- the -Dbuild_time= meson option would not reach the binary" >&2
+      exit 1
+    fi
+    mesonFlagsArray+=("-Dbuild_time=$buildTime")
+  '';
+
   mesonFlags = [
     "-Dcomponent=xcecli"
     ("-Dcommit_id=" + myCommitId)