feat(dirty-content-fingerprint): Nix flake computes fingerprint via self.narHash

Adds myDirtyFingerprint to flake.nix's existing eval-time let block,
computed as builtins.hashString "sha256" self.narHash truncated to 8 hex
chars (self.narHash is SRI base64, not hex -- rehashing is necessary),
gated on the same clean/dirty branch myCommitId already uses. No
preConfigure build-phase hook needed -- self.narHash has no pure-eval trap
unlike build_time's builtins.currentTime. Threaded through
nixSupport/default.nix into xce.nix/xcecli.nix's eval-time mesonFlags as
-Ddirty_fingerprint=, alongside the completely untouched -Dcommit_id=/
myCommitId and build_time's separate preConfigure mechanism.

Verified independently by review with real nix build/nix log inspection
on both xcecore_debug and xcecli: real, non-empty, content-sensitive
values reach mesonConfigurePhase, cross-checked deterministic via an
independent Python recomputation, with commit_id fully unaffected. Full
artifact completion is blocked by a pre-existing, unrelated sandbox
network limitation (confirmed recurring on two disjoint Go module sets),
not caused by this change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/nixSupport/default.nix

@@ -1,6 +1,7 @@
 {
   pkgs,
   myCommitId,
+  myDirtyFingerprint,
   ...
 }:
 let
@@ -10,18 +11,21 @@ let
   # builtins.currentTime is unavailable under flake pure-eval. Only
   # myCommitId (a genuine eval-time/flake-level value) still needs to be
   # passed down.
+  # dirty-content-fingerprint task 2.2: myDirtyFingerprint is forwarded the
+  # same way myCommitId already is -- a second, independent eval-time value,
+  # not a build-phase one.
   xcecore = pkgs.callPackage ./xce.nix {
-    inherit pkgs myCommitId;
+    inherit pkgs myCommitId myDirtyFingerprint;
     withDebug = false;
     withAsan = false;
   };
   xcecore_debug = pkgs.callPackage ./xce.nix {
-    inherit pkgs myCommitId;
+    inherit pkgs myCommitId myDirtyFingerprint;
     withDebug = true;
     withAsan = true;
   };
   xcecli = pkgs.callPackage ./xcecli.nix {
-    inherit pkgs myCommitId;
+    inherit pkgs myCommitId myDirtyFingerprint;
   };
 in
 {

src/nixSupport/xce.nix

@@ -3,6 +3,7 @@
   stdenv,
   pkgs,
   myCommitId,
+  myDirtyFingerprint,
   withDebug? false,
   withAsan? false,
   ...
@@ -128,6 +129,10 @@ stdenv.mkDerivation {
     (lib.optional withDebug "--buildtype=debug")
     (lib.optional withAsan "-Db_sanitize=address")
     ("-Dcommit_id=" + myCommitId)
+    # dirty-content-fingerprint task 2.2: eval-time, plain mesonFlags entry
+    # -- mirrors -Dcommit_id= above, NOT the preConfigure/mesonFlagsArray
+    # build-phase mechanism reserved for build_time (see preConfigure above).
+    ("-Ddirty_fingerprint=" + myDirtyFingerprint)
     "-Dcomponent=xcecore"
   ];
 }

src/nixSupport/xcecli.nix

@@ -3,6 +3,7 @@
   stdenv,
   pkgs,
   myCommitId,
+  myDirtyFingerprint,
   ...
 }:
 
@@ -39,5 +40,9 @@ stdenv.mkDerivation {
   mesonFlags = [
     "-Dcomponent=xcecli"
     ("-Dcommit_id=" + myCommitId)
+    # dirty-content-fingerprint task 2.2: eval-time, plain mesonFlags entry
+    # -- mirrors -Dcommit_id= above, NOT the preConfigure/mesonFlagsArray
+    # build-phase mechanism reserved for build_time (see preConfigure above).
+    ("-Ddirty_fingerprint=" + myDirtyFingerprint)
   ];
 }