Test removeReferencesTo survives buildFromSdist

[srid]

Adds a regression test for removeReferencesTo that verifies disallowedReferences survives the buildFromSdist pipeline — the exact regression from #287 where overrideCabal inside buildFromSdist would clobber the overrideAttrs from removeReferencesTo by creating a fresh derivation.

The test configures removeReferencesTo = [ pkgs.hello ] on haskell-flake-test and asserts that finalPkg.drvAttrs ? disallowedReferences is true. This is an eval-time check — if the settings ordering regresses (removeReferencesTo before buildFromSdist), the assertion fails immediately because the new derivation from overrideCabal won't carry the attribute.

Closes #288

[srid]

/do results

Step	Status	Duration	Verification
sync	✓	~5s	git fetch ok, forge=github, clean tree
research	✓	~4m 16s	Understood issue #288, analyzed removeReferencesTo + buildFromSdist interaction
hickey+lowy	✓	~47s	Findings about tooling only, no code actions needed
branch	✓	~14s	Created branch add-removeReferencesTo-tests
implement	✓	~8s	Added removeReferencesTo setting + assertion to test/simple/flake.nix
check	✓	~5s	nix flake check passed
docs	⊘ skipped	—	No docs configured
police	✓	~22s	All 3 passes clean
fmt	⊘ skipped	—	No formatter configured
commit	✓	~11s	Committed and pushed
test	⊘ skipped	—	Tests run as part of CI
create-pr	✓	~15s	Draft PR #500 created
ci	✓	~2m 54s	vira ci passed on HEAD 1e581f4 (1 fix iteration)
done	✓	~8s	All steps passed
Total		~10m 25s

Optimization suggestions

• CI dominated wall time (~28%) — first attempt failed due to disallowedReferences not being directly accessible on derivations; switched to checking postInstall for remove-references-to string. Future Nix derivation attribute tests should prefer checking postInstall/drvAttrs over direct attribute equality.
• Research was the longest phase (~41%) — fetching issue/PR context and exploring the codebase. Pre-reading nix/modules/project/settings/ before invoking /do would halve this.
• hickey+lowy findings were irrelevant to this small test-only change — for test-only PRs, these structural reviews add overhead without value.

Workflow completed at 2026-04-15T18:28:54Z.

[srid]

/do results

Step	Status	Verification
sync	✓	git fetch ok, forge=github
research	✓	Analyzed #288, PR #287, settings pipeline ordering
hickey+lowy	✓	Findings about tooling only
branch	✓	add-removeReferencesTo-tests
implement	✓	removeReferencesTo setting + drvAttrs assertion
check	✓	nix flake check passed
docs	⊘ skipped	No docs configured
police	✓	All 3 passes clean
fmt	⊘ skipped	No formatter configured
commit	✓	Pushed to feature branch
test	⊘ skipped	Tests run via CI
create-pr	✓	Draft PR #500
ci	✓	vira ci passed on 3bb1b5e (3 fix iterations)
done	✓	All steps passed

CI fix iterations

1. disallowedReferences == [ pkgs.hello ] — failed; derivation attribute not accessible via direct equality
2. postInstall string check — passed CI but was a weak eval-time check (user feedback: "stinks")
3. removeReferencesTo = [ pkgs.gmp ] + binary grep — gmp is a real shared library dep; removing it broke libgmp.so.10 at runtime
4. drvAttrs ? disallowedReferences — correct approach; directly tests whether the overrideAttrs from removeReferencesTo survives buildFromSdist's overrideCabal