docs(DEN-1508): specify deterministic Zed-to-Nix export bundles

[ORESoftware]

Linear

• DEN-1508
• Parent delivery: DEN-1418

Summary

Adds document 24 as the normative implementation contract for the pure renderer under review in zed-pkg/zed-cli#69, and now records the independently executable public Nix helper contract in zed-pkg/zed-cli#73.

The document turns the broad bidirectional architecture in document 23 into an executable Zed → Nix boundary covering:

• planner → renderer → persistence → realization → final-attestation authority separation;
• exact plan, artifact, and immutable Nixpkgs-lock inputs;
• generated flake/package/README/artifact/metadata file map;
• canonical zed.nix-flake-bundle/v1 inventory and domain-separated digest;
• archive traversal, link, special-entry, path, executable, and size defenses;
• reproducibility and source-redaction invariants;
• atomic no-clobber persistence requirements;
• a pure nix flake check --no-build ratchet for fetchZedDeps/mkZedPackage argument and fail-closed metadata assertions;
• the non-overlap between evaluation, real fixed-output, planner, renderer, and external clean-room canaries;
• locked offline Nix certification;
• final zed.nix-adapter/v1 evidence requirements;
• pure, negative, Linux, macOS, clean-room, and tamper test expectations; and
• dependency-ordered merge and definition-of-done criteria.

It explicitly distinguishes the independent zed-pkg package manager from the Zed text editor and keeps unimplemented stages marked as later work.

Related implementation

• zed-pkg/zed-cli#36 — install-shaped fixed-output materialization foundation
• zed-pkg/zed-cli#73 — pure public-helper evaluation ratchet
• zed-pkg/zed-cli#47 and #58 — resolver-only fetch/FOD foundations
• zed-pkg/zed-cli#64 — frozen read-only planner
• zed-pkg/zed-cli#69 — pure deterministic renderer

Exact-head validation

Head 26a61f49830b0e2b2d369dbfa2b86a00e2318d69 is mergeable and green:

• documentation CI run 30841100295;
• agents policy run 30841100905.

The referenced evaluation implementation is independently green across every exact-head workflow on zed-cli#73 head dfa624cecd9ee0025444a9aca4126cf451707979, including Ubuntu/macOS Nix interop.

[linear-code]

DEN-1508

[ORESoftware]

Pushed 26a61f49830b0e2b2d369dbfa2b86a00e2318d69 to add the independently reviewable public Nix helper evaluation boundary from zed-pkg/zed-cli#73. The contract now distinguishes pure nix flake check --no-build assertions from the #36 fixed-output canary and from #64/#69 planner/renderer certification, and records the corrected dependency-ordered merge sequence.

[ORESoftware]

Superseded by the semantic current-main replacement in #26 and closing without discarding this contract.

PR #23 and this PR were parallel branches that both claimed architecture document 24. The resolved sequence preserved every valid document: the clean-room acceptance contract remained unnumbered, recursive installs became document 24, complete constraint solving became document 25, and this exact deterministic Zed→Nix contract was carried forward as document 26.

Replacement head 5ab226d86f6b8c73184d5c31964f5d3408a33a2c passed documentation CI and agents-policy validation and merged as 55df86ec809cb03d48108d80694b8d71953e479a.

No rebase, force-push, wholesale side selection, or document deletion was used.