okf: extract into flakes/okf sub-flake

[kriswill]

What

Moves the okf knowledge-bundle CLI from scripts/okf/ to flakes/okf/ (git mv, history preserved) and makes it a self-contained sub-flake per the house extraction pattern (AGENTS.md / flakes/ccglass precedent) — the first step toward spinning okf out as an independent project consumable by many repos.

• Real package output: packages.<system>.okf ships the TypeScript sources plus vendored node_modules — a fixed-output bun install keyed on bun.lock (the pattern nixpkgs uses for opencode/helix-gpt; no bun packaging helper exists) — under a bun run --prefer-offline --no-install wrapper. No bun build --compile: okf viz bundles the Svelte viewer with Bun.build + bun-plugin-svelte at CLI runtime, so the bun runtime and deps must be present. The lock is pure JS (no os/cpu-conditional packages), so one FOD hash serves all three systems.
• cwd-based repo resolution: lib.ts repoRoot() switched from import.meta.dir/../.. to git rev-parse --show-toplevel, so the store-run binary operates on whatever repo it's invoked in. This is the only generalization taken now — bundle dir stays hardcoded knowledge/, scaffold stays dotfiles-shaped.
• Fast iteration preserved: the dev shell keeps its impure working-tree wrapper (modules/dev.nix, path repointed) — edits stay live with no rebuild. The nix package is for external consumption/parity.
• CI unchanged in spirit: the Pages workflow stays bun-native (no nix), with trigger paths / working-directory / build command repointed to flakes/okf.
• Root wiring: relative-path input with nixpkgs/flake-parts follows; re-exports in modules/packages.nix (perSystem + the aarch64-linux block). No overlay — nothing installs okf system-wide.
• Docs/knowledge: full scripts/okf reference sweep (log.md history untouched); new knowledge/packages/okf.md concept and knowledge/decisions/okf-subflake.md decision record.

Reviewer notes

• The FOD hash needs refreshing when bun.lock changes or a nixpkgs bump changes bun's install layout — loud hash-mismatch failure; procedure documented in flakes/okf/README.md (passthru.node_modules makes it one command).
• okf viz --check / --perf are dev-tree-only (svelte-check writes into node_modules, read-only in the store; --perf needs local Chrome) — documented in the README.
• Root nix flake check doesn't run the sub-flake's checks; use nix flake check ./flakes/okf.
• After merge, a workflow_dispatch of the pages workflow confirms the publish end-to-end.

Verification

• bun test: 238 pass (working tree) and offline in the nix sandbox (checks.<system>.test)
• nix build ./flakes/okf#okf standalone; store binary ran validate and viz (full 2.5 MB viz.html through the store node_modules symlink)
• nix flake check on both flakes; nix build .#okf (exact drv parity with standalone); nix eval of the aarch64-linux/x86_64-linux re-exports
• nix build .#darwinConfigurations.k.system and nebula toplevel cross-eval both green
• okf validate --strict: 0 errors, 0 warnings; fmt/statix/deadnix: no new findings