feat(nix): expose declarative outputs and a home-manager module (task 0045)

Let a Nix configuration declare gitea-axi's ambient context instead of
running a command that writes it. `setup` and `setup hooks` are write-only
against files the operator is assumed to own, so an operator whose agent
configuration is generated cannot use them at all.

The package installs the bundled Agent Skill to share/gitea-axi/skills and
publishes it as `passthru.skill`, alongside `passthru.sessionStartHook` read
from `session-start-hook.json` — a committed declaration the fast tier reads
too, so a test drives `setup hooks` and asserts the two agree.

On top of that, `homeModules.gitea-axi` declares both from those attributes
through home-manager's own Claude Code options, so an operator's existing
skills and SessionStart hooks compose rather than collide. Importing it
without enabling it yields a byte-identical generation.

The spec's Out of Scope entry deferring a home-manager module is deleted;
ADR 0020 records the reversal, and INSTALL.md describes both paths.

flake.nix

@@ -41,6 +41,17 @@
         }
       );
 
+      # Declarative ambient context for an operator whose agent configuration is
+      # generated rather than owned (ADR 0020). Not per-system: it is a module
+      # function, and the package it defaults to comes from the importing
+      # configuration's own `pkgs` rather than from this flake's nixpkgs — which
+      # is how a consumer deduplicates, and the same reason the derivation is a
+      # callable expression rather than a flake-bound one.
+      homeModules = rec {
+        gitea-axi = ./home-manager-module.nix;
+        default = gitea-axi;
+      };
+
       # The toolchain the repository actually needs: the build and the fast tier
       # want Node, the live end-to-end tier and the benchmark harness additionally
       # shell out to `git`, `tea`, and `curl` — none of which the repository