feat(dirty-content-fingerprint): Nix flake computes fingerprint via self.narHash

Adds myDirtyFingerprint to flake.nix's existing eval-time let block,
computed as builtins.hashString "sha256" self.narHash truncated to 8 hex
chars (self.narHash is SRI base64, not hex -- rehashing is necessary),
gated on the same clean/dirty branch myCommitId already uses. No
preConfigure build-phase hook needed -- self.narHash has no pure-eval trap
unlike build_time's builtins.currentTime. Threaded through
nixSupport/default.nix into xce.nix/xcecli.nix's eval-time mesonFlags as
-Ddirty_fingerprint=, alongside the completely untouched -Dcommit_id=/
myCommitId and build_time's separate preConfigure mechanism.

Verified independently by review with real nix build/nix log inspection
on both xcecore_debug and xcecli: real, non-empty, content-sensitive
values reach mesonConfigurePhase, cross-checked deterministic via an
independent Python recomputation, with commit_id fully unaffected. Full
artifact completion is blocked by a pre-existing, unrelated sandbox
network limitation (confirmed recurring on two disjoint Go module sets),
not caused by this change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/nixSupport/xcecli.nix

@@ -3,6 +3,7 @@
   stdenv,
   pkgs,
   myCommitId,
+  myDirtyFingerprint,
   ...
 }:
 
@@ -39,5 +40,9 @@ stdenv.mkDerivation {
   mesonFlags = [
     "-Dcomponent=xcecli"
     ("-Dcommit_id=" + myCommitId)
+    # dirty-content-fingerprint task 2.2: eval-time, plain mesonFlags entry
+    # -- mirrors -Dcommit_id= above, NOT the preConfigure/mesonFlagsArray
+    # build-phase mechanism reserved for build_time (see preConfigure above).
+    ("-Ddirty_fingerprint=" + myDirtyFingerprint)
   ];
 }