qualification: bind exact Git subject to immutable local Nix flake reference for environment resolution

Child of #2466 / #917.

Before a selection-resolution verifier runs Nix, it must ensure the flake evaluator consumes the exact qualification subject rather than ambient working-tree bytes.

Preferred local invocation substrate:

git+file://<repo>?rev=<exact source_commit>#<exact flake output>

or another independently verified equivalent that Nix resolves to the exact declared commit/tree.

Do not treat .#attr from an arbitrary/dirty checkout as equivalent merely because the target repository also contains the declared commit.

The verifier must additionally prove the local Git object database contains the exact commit and declared tree and must capture/reconstruct the resolved flake revision/source identity reported by Nix where available.

Non-claims: local Git object membership does not authenticate remote repository ownership; Nix flake source resolution does not prove recipe execution or provider authenticity.