Floresta distros: declarative, per-host build matrix

[jaoleal]

Until now, the flake exported one ad-hoc output per release (.#master, .#v0_9_1, …), with Android bolted onto master by a separate module (android-outputs.nix) and its own toolchain (fenix). Adding a new target meant new wiring in flake.nix, CI and the attestation code. Nothing was shared between releases and targets except by accident.

This PR adds tooling to declare Floresta distributions (distros). A distro is florestad + floresta-cli built for one place to run, from one release, by one build host. Each distro spells out:

• the build host: which packages.<host> lists it;
• the target: the package set it builds in (native pkgs or a pkgsCross.* set) and the Rust triple;
• the linkage: dynamic by default, or static (checked by an installCheck);
• the patches the target needs, as reusable modules (e.g. lib/patches/android-patches.nix).

Every distro goes through the same builder, so they share one dependency graph:

• Toolchain: built from rust-overlay, reading each release's rust-toolchain.toml.
• Dependencies: vendored crates are fetched as separate per-crate derivations, so releases pinning the same crate versions share them.
• Workspace build: florestad, floresta-cli and libfloresta build in one cargo invocation, so libbitcoinkernel compiles once per build.

Because of this, adding a distro or a release only adds entries: it reuses what is already built and cached instead of adding new wiring.

What changes

Build library

• floresta-build: packageName becomes packageSet, a list of components built in one cargo run. The per-target patches (buildPhase, installPhase, extraEnvVars, extraBuildInputs) become mkFloresta options instead of import-time arguments.
• lib/mkFlorestaDistro.nix (new):
  • mkFlorestaDistro validates a distro spec with the module system and builds it.
  • mkFlorestaDistroForEachTag releases (release: { … }) stamps out one package per release.
  • Both are exposed as lib.mkFlorestaDistro / lib.targetsFor.

Outputs

• lib/targets.nix is the single catalogue: the releases (an ordered list, so releasesSince "0.10.0" is a range) and, per host, the distros it builds. Packages are named florestad-<distro>-v<release>, e.g. florestad-aarch64-darwin-v0_9_1.

• Current matrix:

  Distro	Built on	Releases
  x86_64-linux (dynamic, glibc)	x86_64-linux	0.9.0, 0.9.1, 0.10.0
  aarch64-linux (dynamic, glibc)	aarch64-linux	0.9.0, 0.9.1, 0.10.0
  aarch64-darwin	aarch64-darwin	0.9.0, 0.9.1, 0.10.0
  aarch64-android (NDK)	x86_64-linux	0.10.0

• Naming convention: a distro is dynamic unless its name ends in -static. Only static binaries run outside Nix/NixOS, because dynamic ones load their interpreter and libraries from /nix/store.

CI and release

• ci.yml reads the matrix off nix eval .#packages and builds each package on its host's runner, so a new distro or release needs no workflow edit. It absorbs android.yml.
• build-and-attest.yml builds one release on every host (x86_64-linux, aarch64-linux, aarch64-darwin) and names artifacts <file>-<rustTarget>, matching the attestation manifests.
• just build <distro> <release> builds one package. just build-and-package-all [release] collects every distro (or one release) into artifacts/<release>/, and fails if an existing artifact's bytes differ.

Breaking changes

• The outputs .#master, .#v0_9_0, .#v0_9_1 and .#attestation-manifest-* are gone. Manifests now live at legacyPackages.<host>.attestation-manifests."<version>".
• The floresta-master and fenix inputs are removed, along with the update-master sync workflow.
• The v0.9.0 and v0.9.1 attestations in contrib/sigs/ are dropped. They signed the old workspace builds, which the distro manifests no longer reproduce, so these releases need to be re-attested.
• x86_64-darwin no longer has packages (see below).

Not in this PR / known issues

• Static musl Linux (x86_64-linux-static) is written out but commented: rustc links it as static-pie, and pkgsStatic's libstdc++.a (pulled in by libbitcoinkernel-sys) isn't built with -fPIE.
• Other ABIs: armv7a-android, x86_64-android and x86_64-darwin are commented out until they've been built once.
• Releases are currently fetched from jaoleal/FlorestaBA, and 0.10.0 points at v0.10.0-preview. That tag's Cargo.toml still says 0.9.0, so its store paths are named …-0.9.0. This is temporary until we have 0.10.0 on upstream floresta.

Testing

• CI built every package in the matrix on its native runner (x86_64-linux, aarch64-linux, aarch64-darwin), including the Android distro.
• nix flake check and nix flake check ./examples --no-build pass.
• The refactor keeps the derivations stable: aarch64-darwin and Android drvPaths are unchanged by the mkFlorestaDistroForEachTag rewrite.