fix(nwsync): pin emitter version, ship the shim, harden manifest reads

Review follow-ups on the same work:

- emitter_version is its own sidecar field, not the build revision. Keying
  the merge check on created_with invalidated every published index on every
  unrelated crucible commit, forcing a re-emit of the whole corpus.
- flake.nix builds cmd/crucible-nwsync, so Nix consumers get the binary the
  docs promise.
- readManifest uses io.ReadFull: bytes.Reader.Read can return a short count
  with no error, so a truncated manifest parsed into zero-padded garbage.
- emit refuses a .mod outright and names why, rather than failing on an
  unknown extension.
- SOURCE_DATE_EPOCH pins the sidecar timestamp; the manifest was already
  deterministic.
- Entry.identity replaces the resref/restype key struct duplicated in emit
  and assemble.

Refs #53.

internal/nwsync/assemble.go

@@ -37,15 +37,9 @@ func Assemble(options AssembleOptions) (AssembleResult, error) {
 		return AssembleResult{}, fmt.Errorf("assemble: --order names no artifacts")
 	}
 
-	type key struct {
-		resref  string
-		restype uint16
-	}
 	merged := make([]Entry, 0, 1024)
-	winner := make(map[key]bool, 1024)
+	winner := make(map[Identity]bool, 1024)
 	var onDiskBytes int64
-	emitterVersion := ""
-	emitterSource := ""
 
 	for _, name := range options.Order {
 		manifestPath := filepath.Join(options.EntriesDir, name+".nsym")
@@ -64,19 +58,17 @@ func Assemble(options AssembleOptions) (AssembleResult, error) {
 		// Two producers of blobs means a skewed emitter can write blobs the
 		// merged manifest quietly disagrees with. Refuse to merge across
 		// mismatched emitter versions.
-		if emitterVersion == "" {
-			emitterVersion, emitterSource = sidecar.CreatedWith, name
-		} else if sidecar.CreatedWith != emitterVersion {
+		if sidecar.EmitterVersion != emitterVersion {
 			return AssembleResult{}, fmt.Errorf(
-				"assemble: emitter version mismatch: %s was emitted with %q, %s with %q",
-				emitterSource, emitterVersion, name, sidecar.CreatedWith)
+				"assemble: emitter version mismatch: %s was emitted by emitter %q, this is emitter %q",
+				name, sidecar.EmitterVersion, emitterVersion)
 		}
 		// on_disk_bytes overcounts by the handful of cross-artifact
 		// duplicates. It is a display statistic; no dedupe pass for it.
 		onDiskBytes += sidecar.OnDiskBytes
 
 		for _, entry := range entries {
-			identity := key{resref: entry.ResRef, restype: entry.ResType}
+			identity := entry.identity()
 			if winner[identity] {
 				continue
 			}