fix(colmena): expose colmenaHive for the nix-community evaluator (#361)

* fix(colmena): expose colmenaHive for the new evaluator

nixpkgs now ships the nix-community Colmena rewrite, whose default
evaluator reads an evaluated colmenaHive flake output instead of the raw
colmena hive. Without it every colmena apply recipe failed with
"does not provide attribute colmenaHive".

Add a colmena input pinned to the same v0.5.0 as nixpkgs and expose
colmenaHive = colmena.lib.makeHive <raw hive>, with the raw hive kept as
an internal binding rather than a flake output of its own.

* chore: clean up stale colmena and aquamarine references

- point the Colmena links at nix-community/colmena after the move
- rename the security-aquamarine-metrics test to youko-metrics (it
  already tested youko) and update the outputs README
- drop the commented aquamarine remote-builder example

flake.nix

@@ -85,6 +85,15 @@
       url = "github:nix-community/preservation";
     };
 
+    # Remote deployment via SSH. Pinned to the same v0.5.0 that nixpkgs ships
+    # so the `colmenaHive` output we expose matches the CLI's schema.
+    colmena = {
+      url = "github:nix-community/colmena/v0.5.0";
+      inputs.nixpkgs.follows = "nixpkgs";
+      # Reuse the flake's own stable nixpkgs instead of colmena's pinned copy.
+      inputs.stable.follows = "nixpkgs-stable";
+    };
+
     # secrets management
     # Pinned to a release tag (not a branch) so `just up` cannot move it
     # silently; bump deliberately when a new release is needed.