mars: build Mnemosyne env as a Nix derivation (review rework)

Supersedes the venv-based fix attempt in 694317a entirely: replaces the
runtime side-venv with a python3.withPackages derivation
(pkgs/mnemosyne-env.nix: mnemosyne-memory 3.15.1 + mnemosyne-hermes 0.5.0
via fetchPypi, base deps only). Env mounted :ro into the container; the
oneshot only writes the plugins/mnemosyne symlink to the env's
site-packages passthru — a canonical store path valid on both sides. No
runtime fetch, no stamp, no root-executes-luna-writable-code, no
host/container path mismatch, no config.yaml sed.

hosts/mars/mnemosyne/set-provider.py

@@ -1,45 +0,0 @@
-# Set memory.provider = mnemosyne in Hermes's config.yaml, preserving every
-# other key, comment-free but value-faithful. Written as a separate file so
-# the provisioning unit runs it from the nix store (never inline) and ALWAYS
-# before the venv is chowned to the container uid — root must not execute an
-# interpreter inside a tree luna can write to.
-#
-# Behaviour per config.yaml state:
-#   existing `memory:` mapping (incl. an old `provider:` value)  → merge/replace
-#   `memory: null` or `memory: {}` or key missing                → create mapping
-#   top-level not a mapping                                      → abort loudly
-#   file missing                                                 → SKIP: Hermes's
-#     first-run seeding must create it; a one-key stub would stop that.
-import sys
-
-import yaml
-
-
-def set_provider(path: str) -> int:
-    try:
-        with open(path) as f:
-            data = yaml.safe_load(f) or {}
-    except FileNotFoundError:
-        print(
-            f"WARNING: {path} not found; skipping provider cue (first-run will seed it)",
-            file=sys.stderr,
-        )
-        return 0
-    if not isinstance(data, dict):
-        print(
-            f"ERROR: {path} is a {type(data).__name__}, not a mapping; not touched",
-            file=sys.stderr,
-        )
-        return 1
-    mem = data.get("memory")
-    if isinstance(mem, dict):
-        mem["provider"] = "mnemosyne"
-    else:
-        data["memory"] = {"provider": "mnemosyne"}
-    with open(path, "w") as f:
-        yaml.safe_dump(data, f, sort_keys=False)
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(set_provider(sys.argv[1]))