flake: Rust 1.98.1 from rust-overlay; rust-version 1.98

The owner's hosts (titan, talos) run 1.98.1; nixos-26.05's Rust is
1.95.0, so builds and lints differed by host. The flake gains a second
input, oxalica's rust-overlay (following our nixpkgs, so host configs
can still follow theirs), and both the package build and the dev shell
use its stable 1.98.1 with clippy and rustfmt. The workspace's
rust-version rises to 1.98 to match; AGENTS.md, docs/dependencies.md
and the M5c-1 plan follow.

Checked on straylight: nix build gives all seven binaries; the dev
shell has rustc, cargo and clippy 1.98.1, rustfmt 1.9.0, cargo-deny
0.19.6; make gate in it passes with 1122 tests, as on titan.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

flake.nix

@@ -1,13 +1,40 @@
 {
   description = "boxmaker: a sovereign personal agent harness";
 
-  inputs.nixpkgs.url = "nixpkgs/nixos-26.05";
+  inputs = {
+    nixpkgs.url = "nixpkgs/nixos-26.05";
+    # The Rust toolchain, pinned below, independent of the host's nixpkgs release.
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
 
   outputs =
-    { self, nixpkgs }:
+    {
+      self,
+      nixpkgs,
+      rust-overlay,
+    }:
     let
       systems = [ "x86_64-linux" ];
       forAllSystems = nixpkgs.lib.genAttrs systems;
+      # nixpkgs with rust-overlay, and the one Rust toolchain every host uses (the workspace's
+      # `rust-version`): cargo, rustc, clippy and rustfmt.
+      pkgsFor =
+        system:
+        import nixpkgs {
+          inherit system;
+          overlays = [ rust-overlay.overlays.default ];
+        };
+      toolchainFor =
+        pkgs:
+        pkgs.rust-bin.stable."1.98.1".default.override {
+          extensions = [
+            "clippy"
+            "rustfmt"
+          ];
+        };
       version =
         if self ? shortRev then
           self.shortRev
@@ -20,7 +47,12 @@
       packages = forAllSystems (
         system:
         let
-          pkgs = nixpkgs.legacyPackages.${system};
+          pkgs = pkgsFor system;
+          toolchain = toolchainFor pkgs;
+          rustPlatform = pkgs.makeRustPlatform {
+            cargo = toolchain;
+            rustc = toolchain;
+          };
           lib = pkgs.lib;
           # Only what the build reads: no target/, no .state/, no docs.
           src = lib.cleanSourceWith {
@@ -33,7 +65,7 @@
               rel == "Cargo.toml" || rel == "Cargo.lock" || rel == "crates" || lib.hasPrefix "crates/" rel;
           };
           # Every binary of the workspace: the roles, bxctl and toolkit.
-          boxmaker = pkgs.rustPlatform.buildRustPackage {
+          boxmaker = rustPlatform.buildRustPackage {
             pname = "boxmaker";
             inherit version src;
             cargoLock.lockFile = ./Cargo.lock;
@@ -57,15 +89,12 @@
       devShells = forAllSystems (
         system:
         let
-          pkgs = nixpkgs.legacyPackages.${system};
+          pkgs = pkgsFor system;
         in
         {
           default = pkgs.mkShell {
             nativeBuildInputs = [
-              pkgs.cargo
-              pkgs.rustc
-              pkgs.clippy
-              pkgs.rustfmt
+              (toolchainFor pkgs)
               pkgs.cargo-deny
               pkgs.gnumake
             ];