Migrate ZIPs rendering to nix build, add merge-acceptance gates, and introduce repo formatting workflow

[Copilot]

This PR aligns local/CI rendering on flake-based nix build outputs and reduces working-tree noise from Nix artifacts. It also introduces a markdown formatting workflow (dprint) and updates repository script layout to support consistent automation.

• Flake outputs and Nix artifact hygiene

  • Added /result to .gitignore.
  • Added flake package outputs for all, all-zips, all-specs, with default as all.
  • Kept output shape compatible with existing render consumption (rendered/ + README.rst).

• Production render path switched to nix build

  • Updated .github/actions/render/action.yml to build via flake and copy from ./result into workspace outputs.
  • Ensures production render step consumes the same build product expected by local Nix workflows.

• Merge acceptance workflow

  • Added merge-acceptance workflow for PR/manual runs.
  • Runs full nix build render path.
  • Adds formatting gate with ./scripts/format.sh check.
  • Sets explicit minimal workflow token permissions (contents: read).

• Developer shell and formatting tooling

  • Added dprint to nix develop shell.
  • Made markdown plugin available via flake input (flake = false) and local vendored WASM path.
  • Added dprint.json targeting repo markdown files.

• Script layout and command surface

  • Moved top-level .sh/.py scripts into ./scripts/.
  • Updated references in Makefiles and script usage strings to new paths.
  • Added ./scripts/format.sh with help, check, rewrite, and commit-rewrite behaviors (including clean-tree enforcement for commit mode).

# .github/actions/render/action.yml
- name: Render with nix build
  shell: bash
  run: |
    nix build
    cp -a ./result/rendered/. ./rendered/
    cp -a ./result/README.rst ./README.rst