feat: add tack loader

[xfo-0]

Adds a tack loader, as the flake-file tack backend's "other half" (vic's suggestion on denful/flake-file#120): loading flake-likes straight from tack pins, with no dependency on flake-file.

from.tack

Reads .tack/pins.toml + .tack/pins.lock.json and produces a with-inputs sources set:

• Fetching uses the same stable builtins as the other loaders (fetchTarball for github/tarball nodes with narHash, fetchGit for git nodes, and tack's builtin:fetchurl/builtin:unpack-channel derivation pair for fixed pins) — no fetchTree, no experimental features.
• Pin semantics from pins.toml are honored: type = "fetch" (or legacy flake = false) marks the source flake = false so with-inputs won't flake-load it; dir appends a subdirectory to the source path; unpack selects the fixed-pin layout.
• [all_follow] rows translate to alias source entries (both alias = "target" and target = ["aliases"] forms). Since with-inputs already resolves sub-inputs by name from allInputs, an alias entry sharing the target's source reproduces the tack resolver's follows-everywhere behavior with no extra machinery.

Per-pin follows tables are left to the standard follows.nix override mechanism.

Template

templates/tack mirrors the lon template (same den.nix/outputs.nix/follows.nix), with with-inputs.nix bootstrapping with-inputs itself from the lock and a vendored .tack/ (pins + lock, no resolver — with-inputs replaces it).

Verification

• just loader tack passes (evaluates nixosConfigurations.igloo...tux.home.username → tux through the real lock).
• nix-unit ./tests.nix: 36/36.
• treefmt --ci clean.

🤖 Generated with Claude Code

[vic]

Awesome, thanks!