pm/lock.json lists provenance sidecars (checksums.txt, .sig/.pem/.asc)
next to the tirith and iron-proxy archives; pm verifies them at install
time. nix/pm-packages.nix fed every artifact to srcs, and stdenv's
unpackPhase has no unpacker for a .txt, so `nix build .#pm-tirith`
failed with "do not know how to unpack source archive". `nix flake
check` only evaluated the pm derivations, which is why CI stayed green.
srcs now keeps the suffixes pm/store.py::extract unpacks; the
fixed-output hash already pins the archive. A new check builds the two
sidecar-bearing pins so the regression cannot hide behind evaluation.
e34214118f