fix: Make source updates safe and simplify Nix packaging

[Fuwn]

Yae could truncate its environment file during a failed save, interpret source URLs via a shell during tag discovery, and create sources without complete hashes. This change makes updates safer while retaining the single-file environment format.

• Replace the shell pipeline with direct Git arguments and explicit tag filtering.
• Save environments atomically, preserve symlinks and existing permissions, and save updates only after all selected sources succeed.
• Populate both hash formats, repair missing legacy hashes, and validate source configuration while accepting harmless legacy binary options.
• Simplify subprocess execution and update orchestration, support cancellation, and correct CLI argument handling, help, logging flags, and dry-run wording.
• Simplify Nix packaging, declare Git/Nix runtime dependencies, and add focused Go regression tests and CI checks.
• Correct floating-source examples and make targeted README corrections while preserving its structure and integration examples.

Validation

• Race-enabled Go tests, go vet, module tidiness, formatting, and whitespace checks passed.
• Native Apple Silicon macOS Nix checks passed, including schema validation and packaged execution with real Git/Nix, an empty PATH, and an isolated Nix store.
• The Ubuntu workflow passed locally via act under x86-64 emulation. Nix syscall filtering was disabled only inside that container to accommodate emulation.
• Local Linux CI exposed a build-home isolation issue, which this change fixes.