mkFlakePackages: only expose components in the install plan (#2028) - #2548

Summary

mkFlake exposed every component of every local package as a flake package, so a private sub-library that exists only to serve a disabled test suite was still built by hydraJobs.packages (#2028). The right criterion (andreabedini's, on the issue) is: build exactly the components that appear in the cabal install plan.

mkFlakePackages and mkFlakeApps now skip components that are not in the plan, using a small flakeComponentIsPlanned predicate:

flakeComponentIsPlanned = component:
  (component.config.buildable or true) && (component.config.planned or false);

• planned is set to true by plan-to-nix for every component in plan.json (project-wide for stack projects); buildable comes from the .cabal file / module overrides. These are reachable on a built component via its passthru.config (builder/comp-builder.nix).
• This mirrors the buildable && planned filter already used by config.allComponent (modules/package.nix) and applyComponents (lib/default.nix), so flake packages now agree with what the rest of the code already considers "real".

Safety

planned is a plain bool (default false), so there is no null/unknown case: excluding planned == false is exactly "require planned == true", which is the same condition the existing allComponent/applyComponents filters use. A component is dropped only when the install plan says it is not planned — nothing currently exposed is hidden otherwise.

Scope kept tight: this changes flake packages/apps (the subject of the issue). The checks-collection path (collectChecks'/mkFlakeChecks) is left as-is.

Tests

Added two runnable unit tests in test/unit.nix (they exercise the real haskellLib.mkFlakePackages / haskellLib.flakeComponentIsPlanned, not a copy):

• test-flakeComponentIsPlanned — the predicate's truth table incl. default handling.
• test-mkFlakePackages-filters-unplanned — a package fixture whose unplanned private sub-library and disabled test suite are dropped, while the planned library, sub-library and exe are kept.

Ran the full unit.tests suite locally (nix-build … -A unit.tests then nix-instantiate --eval --strict … -A unit.tests) → [] (all pass, including the two new tests).

Caveats

• I could not run a full real-project flake eval locally: building any project's plan-nix in this environment failed on an unrelated environmental fixed-output hash mismatch fetching the head.hackage index. The unit tests exercise the actual exported code path, and reachability of .config.planned/.config.buildable on built components is guaranteed by existing code that already reads those same fields on the same config object.

Closes #2028.