feat(labels): Publish a project's own nix files, not just its flake

feat(upstreams): Ship secretspec as an inputless flake carrying the package

feat(module): Force the fine build's test derivations through a check

feat: State a reason at every secret access

experiment: Take the root from self via a static top level

doc: State why the tree call names its root