Replaces hand-rolled schemaEntryType with gen-schema mkSchemaOption.
Sidecars: includes, excludes. Computed: isEntity (structural content only).
Extracts resolvedCtxModule (id_hash, resolved, collisionPolicy) to
_types.nix for entity type reuse. collisionPolicy flows through deferred
module merge to entity instances (not a sidecar) preserving existing
ctx.host.collisionPolicy resolution path.

den.hosts now accepts both forms:
  - Legacy: den.hosts.x86_64-linux.igloo = { ... }
  - Flat:   den.hosts.igloo = { system = "x86_64-linux"; ... }

The outer option type uses a permissive submodule with deepMergeAttrs
freeformType (lib.recursiveUpdate-based merge that avoids the infinite
recursion lib.types.anything causes with cross-option references).
The apply function preprocesses flat entries into two-level form and
re-evaluates through the original attrsOf systemType, so all 6
consumers see the canonical { system.name = hostConfig } shape.

Same pattern as den.hosts: deepMergeAttrs + preprocessHosts + apply.
Cross-entity host lookup and osConfig injection preserved.

Covers: id_hash, freeform, topology, meta introspection,
isEntity computed, schema includes sidecar.

Update flake inputs and references to match the renamed repo
at github:sini/gen-schema.

…ted signature

gen-schema flattened _meta into _-prefixed options and renamed
sidecars → collections. nix-effects changed bindAttrs so true is a
literal param, not an optionality marker — translate __args values
to fx.bind.optionalArg before bind.fn.

Build host/user/home submodules with gen-schema's mkInstanceType, which
injects name, strict/freeform, _module.args.<kind>, and schema-owned
id_hash (gen-algebra mkIdentityModule) — replacing the hand-rolled id_hash
reflection in resolvedCtxModule. Identity now shares the exact algorithm
gen-schema's ref/setOf dedup compares against, removing the drift hazard
between den's copy and the library's.

Add an entity-gen-schema test pinning _roots: host is a root scope and
user/home are not (the buildRoots root-detection contract).

den.reservedKeys fed structuralKeysSet, which the pipeline classifier and
the synthetic-_ childKeys filter honored — but the aspect submodule's
freeform value type (aspectKeyType) wrapped every undeclared key into the
__contentValues/__provider provenance shape regardless. A reserved key was
excluded from dispatch but its value was still mangled, so consumers could
not read it back as the metadata den.reservedKeys promises.

Route structural/reserved keys through a passthrough merge (last def wins)
in aspectKeyType — the per-key dispatch the type comment already
anticipated. den.aspects.<name>.<reservedKey> now returns the raw value.