refactor(flake): split assembly by concept

guests/sample.nix

@@ -1,5 +1,5 @@
-args@{ dotfiles, ... }:
+args@{ flake, ... }:
 # The tracer-bullet guest: the thinnest complete path from discovery to a
 # running nested container. Its interior is just the guest-base — the baseline
 # toolset and SSH access — so it proves the concept without carrying a service.
-dotfiles.guest { name = "sample"; } args
+flake.mkGuest { name = "sample"; } args