feat: add devenv.preFlight for pre-init env injection

[ap-1]

A few of devenv's own subsystems (cachix push auth, substituter netrc) read environment variables at process startup, before any module-declared env.X is exported into the resulting shell. Values fetched at module-evaluation time can't reach those subsystems.

For organizations that store CACHIX_AUTH_TOKEN in a secret manager (Vault, OpenBao, 1Password, secretspec), this means there's no way to feed the token into devenv-core's cachix init without each developer running cachix authtoken <token> manually first. The cachix daemon spawns with whatever env devenv was launched with, which doesn't include anything modules declare.

This PR adds a new devenv.preFlight option (attrsOf submodule { command = str; }). Each command is run, in alphabetical key order, before subsystem initialization. Lines of KEY=value written to stdout are merged into devenv's process environment, so the subsequent env::var() reads in devenv-core (cachix, etc.) see them.

devenv.preFlight.cachix-auth.command = ''
  echo "CACHIX_AUTH_TOKEN=$(${pkgs.openbao}/bin/bao kv get \
    -address=https://vault.example.com \
    -field=CACHIX_AUTH_TOKEN secret/cachix)"
'';