feat: exposes standalone bootstrap writer targets

[kalyanoliveira]

Summary

Exposes each bootstrap writer as a standalone top-level nix-shell -A target.

What changed

• Adds top-level writer targets such as write-flake, write-npins,
  write-tack, and bootstrap.
• Keeps flake-file.sh as the existing aggregate all-writers shell.
• Updates bootstrap docs and examples to prefer standalone targets for one-off
  commands.
• Adds tests for the public write-flake path and for isolation from unrelated
  apps.

Why

The documented command used the aggregate shell:

nix-shell <source> -A flake-file.sh --run write-flake

That shell realizes every registered backend before running the selected
command. As a result, running write-flake could fail because an unrelated
backend, such as Tack (see my other PR related to this, for instance), failed
to build.

The preferred command is now:

nix-shell <source> -A write-flake --run write-flake

This realizes only the dependencies required for write-flake.

Testing

git switch feat/top-level-writer-targets
nix-build . -A write-flake
nix-shell . -A write-flake --run write-flake
out="$(nix-build . -A write-flake --no-out-link)"
nix-store -qR "$out" | grep tack && exit 1 || true

Result: passed locally. The closure grep did not print Tack. Feel free to test
for yourself.

Note: full test-all on this branch alone may still be blocked by the old Tack
pin from main. That is fixed by my PR fix/tack-libgit2-compat.

Related work

This PR is best reviewed after fix/tack-libgit2-compat, because that PR
unblocks CI failures caused by the old Tack package.

The combined integration branch has also been validated:

chore/integration-verify-bootstrap-fixes

On that branch, nix-shell ./dev/bootstrap-tests.nix --run test-all passes with
this PR merged together with other related fixes.

[vic]

lgtm, the new broken-app test naturally fails (exit code 1 as intended by its shell app), can you please make sure the CI test is successful ?