Give `src/`, `api/`, `panel/` and `nix-module-form/` their own
`flake.nix`+`default.nix`(+`shell.nix`/`treefmt.nix`), following the root's
transparent-wrapper pattern, and move each root output to the leaf that owns it:

- `src/` gets the orchestration surface: `nixosConfigurations`, the
  `<group>-<effect>-<machine>` deployment packages/apps/devShells,
  `legacyPackages`, `core-docs`, the `src`-scoped `formatter`, and the nix/infra
  `default` dev shell.
- `api/`, `panel/`, `nix-module-form/` each own their `packages`, `checks`,
  `formatter` and `devShells`, including that leaf's own `treefmt` check.

The root stays thin, retaining only what is inherently root-anchored: the #972
deploying-vs-deployed `boundary` (its `deploymentPlan` resolves `caller` via
`import (repoRoot + "/${caller}")`, and callers span both `src/` and `checks/`),
the repo-wide pre-commit hook, and the infra/cross-cutting checks aggregator.
`README.md` and inline comments document why the root cannot be removed and the
out-of-tree `npins` / flake-mode caveat (flake mode only sees git-tracked files,
so a leaf's `../npins` resolves only because `npins/` is tracked at the root).

CI (`nix-flake-check.sh` + hand-maintained YAMLs) is rewired to address each
entrypoint directly: leaf checks build through `./<leaf>#`, `nixosConfigurations`
through `nix-build ./src -A`, and the split deploy path threads the authoritative
whole-repo #213 self-pin via `SELF_MODULE_SOURCE`. The generator enumerates
subdir flakes via explicit `git+file://<repo>?dir=<sub>` URLs (a bare subdir path
would copy only that subtree and lose `../npins`).

Parity verified by drvPath equality (path vs flake mode) for the moved leaf and
`src` outputs; the generator `check` idempotency gate passes.

Assisted-by: Claude:claude-opus-4-8

@@ -37,2 +37,3 @@
       - name: Deploy
-        run: nix-shell --run 'eval "$(ssh-agent -s)" && ssh-add ~/.ssh/id_ed25519 && SHELL=$(which bash) nix --extra-experimental-features "nix-command flakes" run ".#dev-ssh-forgejo-runner"'
+        run: |
+          export SELF_MODULE_SOURCE=$(nix --extra-experimental-features "nix-command flakes" eval --json ".#selfModuleSource")

@@ -0,0 +14,4 @@
+  # `git rev-parse --show-toplevel`, which is worktree-aware (a git worktree's
+  # `.git` is a file, not a directory, so the default `.git/config` anchor
+  # resolves to the wrong root). See the root `treefmt.nix` for the full story.
+  projectRootFile = null;

@@ -3,8 +3,7 @@
   outputs =
     { self, ... }:
     import ./default.nix {
-      inherit self;

@@ -0,0 +20,4 @@
+    steps:
+      - uses: actions/checkout@v4
+      - run: |
+          nix --extra-experimental-features 'nix-command flakes' build ".#checks.x86_64-linux.pre-commit" -L

@@ -17,3 +17,2 @@
 jobs:
-  flake-show:
-    runs-on: native-16g
+  flake-show-root:

@@ -60,0 +86,4 @@
+      # `operatorPin == null` path), so there is no pin to resolve here; the
+      # parameter exists solely to honor the call shape.
+      # deadnix: skip
+      operatorPin ? null,

@@ -0,0 +10,4 @@
+      systems = [ "x86_64-linux" ];
+      # Each `leaf.<key>.<system>` is already keyed by that one system, so a
+      # plain attribute merge across systems suffices (distinct keys).
+      perSystem =

@@ -322,20 +350,22 @@ let
   flakeGroups = [

@@ -310,1 +363,4 @@
+      # for introspection; it is baked directly into the re-exported deployment
+      # attributes above (via `srcFor`), so consumers deploy `.#<group>-...` and
+      # need not read it out-of-band. A flat compat attr, not a flake output.
       inherit selfModuleSource;

@@ -27,2 +25,2 @@
-      checks = perSystem "checks";
-    };
+    lib.foldl' (
+      acc: system: lib.recursiveUpdate acc (import ./. { inherit system; }).flake

@@ -0,0 +464,4 @@
+                openapi-client
+                ;
+              api = (callPackage ../api { inherit sources selfModuleSource; }).packages;
+              nix-module-form = (callPackage ../nix-module-form { inherit sources; }).packages;