chore(fmt): pin formatters, enforce in CI, ban drive-by reformatting (#5264)
## Summary
- Pin `nixfmt-rfc-style` and `cabal-fmt` in the dev shell so every
contributor and every CI job use the same version of every formatter.
- Add `just fmt` (runs `fourmolu` + `cabal-fmt` + `nixfmt`) and `just
check-fmt` (runs the CI script locally).
- Extend `scripts/ci/check-code-format.sh` so CI actually enforces
`nixfmt` on every tracked `*.nix` file.
- One-time sweep: normalise all `*.nix` with `nixfmt 1.1.0` so the tree
matches what CI now enforces. No semantic changes.
- Document the rule in `CONTRIBUTING.md` and
`docs/.../coding-standards.md`: **no drive-by reformatting.** A style
change and a semantic change must not share a commit, and formatter
switches are out of scope for feature/fix PRs.
## Why
PR #5258 re-formatted `flake.nix` unilaterally with `alejandra`, tucking
the formatter swap inside a 7-line feature. That pattern — mixing style
and semantics, plus changing formatter with no repo-wide decision —
makes diffs unreviewable and `git blame` useless. This PR closes the
loophole: one canonical formatter per language, pinned, CI-enforced,
documented.
## Commits
1. `style: normalise all *.nix files with nixfmt 1.1.0` — the one-time
sweep (1198/954 lines, formatter-only).
2. `chore(nix): pin formatters in dev shell, add just fmt, enforce
nixfmt in CI`.
3. `docs(contributing): pin formatters, ban drive-by reformatting`.
## Test plan
- [x] `just check-fmt` passes on a clean tree.
- [x] `just fmt` is a no-op on a clean tree.
- [x] Each commit individually evaluates the flake (`nix eval
.#cardano-wallet.name`).
- [x] CI green on PR.