test(007): red proving tests for the devShell overlay/hix rewiring

Writes the criteria-table-to-test mapping for
docs/changes/007-bd-via-hix-shell-extension-point.md before any
implementation lands (formula B, step B1b):

- scripts/devshell-check (new): --self-test (no nix, seconds) proves C1
  (flake.nix composes no mkShell/inputsFrom/devShells override), C2 (overlay
  injects exactly one namespaced neohaskellTools attribute; bare `bd` shadowing
  and beads.overlays.default/nixpkgs.follows rejected), C3 (nix/hix.nix reaches
  bd via shell.buildInputs, not shell.tools, with every pre-existing shell
  declaration still present), C8 (README AC3 recipe checked against the real
  attribute name, so a rename breaks the doc check). Default in-shell mode
  proves C4 (bd store-path identity + >=1.1.0 floor), C5 (every declared tool
  resolves under /nix/store; hoogle is nixpkgs', not haskell.nix's wrapper),
  C6 (toolchain-fp determinism + NEOHASKELL_SHELL_FP/PATH witnesses).
- dev: registers the `devshell-check` verb.
- scripts/workflow-check: C7 fixtures (check_devshell_check_in_shell,
  check_devshell_check_selftest) wired into run() for test.yml `build`,
  test-macos.yml `tests-macos`, and checks.yml `doctor`; 9 new --self-test
  cases proving the checker logic itself.
- .github/workflows/{test,test-macos}.yml: nix-develop devshell-check step
  after the cabal build.
- .github/workflows/checks.yml: --self-test step in the nix-free doctor job.

No production code touched (flake.nix, nix/hix.nix, README.md are the
implementer's edit set) — this change has zero Haskell surface per the
spec's Primitives section, so no Main.hs/cabal registration applies.

Verified red for the right reason: `./dev devshell-check --self-test` fails
C1/C2/C3/C8 because the overlay/buildInputs wiring doesn't exist yet; C5/C6
already hold under the pre-change inputsFrom wiring (expected, not a gap).
`./dev workflow-check` (17 workflows) and its --self-test (incl. the 9 new
fixtures) pass; `./dev doctor` OK; `spec-check --criteria-tests` resolves
all 8 criteria's named tests.

Bead: nh-mol-go3

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: NickSeagull

.github/workflows/checks.yml

@@ -37,6 +37,8 @@ jobs:
       # Static workflow wiring: hidden-artifact upload opt-in + retrospect
       # loop stays deterministic/report-only (pure stdlib, no toolchain).
       - run: ./dev workflow-check
+      # Change 007 static proving tests (C1-C3, C8) — no nix needed.
+      - run: ./dev devshell-check --self-test
 
   codemap:
     name: codemap check (localization ontology)

.github/workflows/test-macos.yml

@@ -76,5 +76,8 @@ jobs:
       - name: Build the project with cabal
         run: nix develop --command cabal build all --disable-documentation
 
+      - name: devShell proving tests (change 007 — C4-C6)
+        run: nix develop --command ./dev devshell-check
+
       - name: Run ${{ matrix.test-suite }}
         run: nix develop --command cabal test ${{ matrix.test-suite }}

.github/workflows/test.yml

@@ -101,6 +101,8 @@ jobs:
             ${{ runner.os }}-cabal-
       - name: Build the project with cabal
         run: nix develop --command cabal build all --disable-documentation
+      - name: devShell proving tests (change 007 — C4-C6)
+        run: nix develop --command ./dev devshell-check
       - uses: actions/upload-artifact@v7
         with:
           name: dist-newstyle

dev

@@ -70,6 +70,11 @@ usage: ./dev <verb> [args]
                           doctrine (see telemetry/SCHEMA.md); never for ad-hoc runs
   workflow-check        static wiring checks for .github/workflows (hidden
                           artifacts, retrospect loop; CI-enforced)
+  devshell-check         proving tests for change 007 (bd via hix's shell
+                          extension point): flake.nix/nix/hix.nix wiring +
+                          README doc-coherence (--self-test, no nix); bd
+                          store-path identity, tool inventory, fingerprint
+                          witness (default, run inside nix develop)
   neo-skills-check      validate the Rust `neo/**` agent-guidance layer:
                           neo-cli-* skills, neo/** routing, no stale state/plan
                           refs, one source of truth (via ./dev doctor + CI)
@@ -135,6 +140,7 @@ case "${VERB}" in
   retrospect) exec scripts/retrospect "$@" ;;
   telemetry) exec scripts/telemetry.py "$@" ;;
   workflow-check) exec scripts/workflow-check "$@" ;;
+  devshell-check) exec scripts/devshell-check "$@" ;;
   neo-skills-check) exec scripts/neo-skills-check "$@" ;;
   neo-dist-check) exec scripts/neo-dist-check "$@" ;;
   neo-consumer-contract) exec scripts/neo-consumer-contract "$@" ;;