refactor(nixpak): split policy checks into per-app suites (#493)

* refactor(nixpak): split policy checks into per-app suites

Make hardening/tests/policy.nix a small loader that auto-discovers one suite per app under hardening/tests/policy. Shared checks live in policy-lib.nix and common expectations are generated by mkAppPolicy; app files only declare differences and special cases. The loader also discovers wrappers from hardening/nixpaks and fails when wrapper/suite inventory or check names diverge.

Assisted-by: DeepSeek Harness (deepseek-flash)

* fix(nixpak): reject duplicate per-app policy checks

mkAppPolicy merges generated and custom checks, so an extraChecks key could silently override a standard assertion. Fail explicitly when a per-app check name is defined twice.

Assisted-by: DeepSeek Harness (deepseek-flash)

outputs/x86_64-linux/tests/nixpak-policy/expr.nix

@@ -1,9 +1,14 @@
-{ inputs, outputs, ... }:
+{
+  inputs,
+  mylib,
+  outputs,
+  ...
+}:
 let
   pkgs = outputs.nixosConfigurations.ai-niri.pkgs;
 in
 import ../../../../hardening/tests/policy.nix {
-  inherit pkgs;
+  inherit pkgs mylib;
   mkNixPak = inputs.nixpak.lib.nixpak {
     inherit pkgs;
     inherit (pkgs) lib;